Pith. sign in

REVIEW 2 major objections 4 minor 59 references

Privacy Accounting and Quality Control in the Sage Differentially Private ML Platform

T0 review · 2 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Block composition lets a machine-learning platform enforce global differential privacy over an endless data stream without exhausting the privacy budget.

desk verdict Block composition is a sound and useful contribution to DP systems; the 'with high probability' quality guarantee for privacy-adaptive training is unproven due to optional stopping. read the letter →

arxiv 1909.01502 v2 pith:QSGYYQRN submitted 2019-09-04 stat.ML cs.CRcs.LG

Mathias Lecuyer , Riley Spahn , Kiran Vodrahalli , Roxana Geambasu , Daniel Hsu This is my paper · ORCID
classification stat.MLcs.CRcs.LG MSC 68P2768T05
keywords differentialprivacyblockcompositiongrowingdatabasesbudgetmachinelearningplatformprivacy-adaptivetrainingSLAedvalidationdatastream
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper presents Sage, a machine-learning platform that promises a global differential-privacy (DP) guarantee over every model and feature ever released from a sensitive data stream. Its central proposal, block composition, splits the stream into blocks, such as one day of data per block, and charges the privacy loss of each query only to the blocks that query actually uses. When a block's loss reaches the configured ceiling, Sage retires that block; new blocks arrive with zero accumulated loss, so training can continue indefinitely as long as the stream grows fast enough. For the second half of the problem, privacy-adaptive training repeatedly retrains a model on more data and/or a larger privacy budget until a DP-aware validator accepts it with high probability as meeting the developer's quality target. The result is an accounting method tuned to how real ML workloads interact with data: overlapping, adaptively chosen subsets of a growing database rather than a single static dataset.

What carries the argument

Block composition is the central object: a privacy-accounting scheme that splits a data stream into disjoint blocks and accounts for each DP query's privacy loss only on the blocks the query touches. The load-bearing mechanism is the per-block access-control check in Theorem 4.3: a query is allowed only if, for every block it uses, the running totals of the query's $\epsilon_i$ and $\delta_i$ remain below the global ceilings. This works because future data blocks are assumed to depend on prior outputs only through DP-released models, so an adversarial change to one record affects one block and no other block's query outputs change. The same construction also powers privacy-adaptive training, since block composition explicitly supports adaptivity in the choice of blocks, privacy parameters, and queries. The proof of Theorem 4.2 reduces block-level accounting to ordinary query-level composition on each block, and Theorem 4.3 lifts that result to streams with adaptive budget choices.

What would settle it

Take a Sage-deployed pipeline whose preprocessing computes a global min-max or z-score scaler on the raw training data and uses the fitted parameters to transform features before a DP layer. If an auditor measures membership-inference accuracy on the released model and finds it clearly above what $(\epsilon_g,\delta_g)$-DP permits, the block accounting has not captured that data-dependent preprocessing step, and the paper's global-guarantee claim fails in that configuration.

Watch

Extended reading notes

Core claim

The paper's main claim is that global DP can be enforced over an entire evolving data stream without ever exhausting the stream's privacy budget, provided the database grows in new blocks faster than models consume them. Formally, Theorem 4.3 states that the AdaptiveStreamBlockCompose protocol is $(\epsilon_g,\delta_g)$-DP if, for every block, the access control keeps the sum of the $\epsilon_i$ (and $\delta_i$) of all queries using that block below the corresponding global ceiling. The proof reduces the privacy loss of the whole interaction to the maximum privacy loss over individual blocks, because a single added or removed record lies in one block, and queries not seeing that block contribute a privacy-loss ratio of one. Sage implements this protocol as an access-control layer: it deducts requested $(\epsilon,\delta)$ budgets from the blocks a pipeline asks for, denies access to blocks whose budgets are exhausted, and trusts each pipeline to be DP. It then couples this accounting with privacy-adaptive training, which doubles the privacy budget or training-set size on retries and uses SLAed DP validators to accept, reject, or retry a model with high-probability guarantees. A sympathetic reading: Sage's contribution is not a new DP learning algorithm but a systems layer that makes the existing DP-ML literature usable on the growing-database workloads real companies run.

Load-bearing premise

The global DP guarantee holds only if every training pipeline really is as private as declared: Sage accounts for budgets but does not verify that preprocessing, training, or validation code implements DP, so any data-dependent transformation outside the DP wrappers leaks information that no block budget charge captures.

Editorial extensions

If this is right

  • A company can keep releasing models from a sensitive stream indefinitely, as long as new data blocks arrive before the current blocks' budgets are spent.
  • Privacy loss is no longer charged globally against the whole database, so a pipeline that touches only recent data does not consume budget for old blocks.
  • Combining blocks before a single noisy computation, rather than answering per-block queries and aggregating, preserves model quality and validation power at the same total privacy cost.
  • With privacy-adaptive training, a model's release can carry a high-probability guarantee that it met the developer's quality target, even though training and validation are both DP.
  • Budget-conserving retry strategies let multi-pipeline workloads release more models per hour under a fixed global $(\epsilon,\delta)$ ceiling.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same per-block accounting could apply to non-ML analytics on growing databases, such as continuously released statistics over rolling time windows, where the ceiling would be per time block instead of per query.
  • A natural stress test: if the stream's block arrival rate drops below the rate at which pending pipelines consume budget, the endless-operation guarantee collapses to the static-database regime; practitioners should measure that ratio before adopting Sage.
  • Sage's strongest guarantee is event-level; the paper itself notes that user-level privacy requires new users to arrive faster than models are released, which mature companies may not satisfy. A useful extension would adapt block composition to user-group shards with a replenishment analysis.
  • The trust boundary suggests an auditing layer: automated checks that no preprocessing step computes data-dependent non-DP quantities would close the main gap between Sage's accounting and a verifiable end-to-end guarantee.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper presents Sage, a differentially private machine-learning platform that enforces a global (εg,δg)-DP guarantee over all models released from a sensitive data stream. Its first contribution is block composition, which partitions the stream into blocks and charges each query's privacy loss only to the blocks it actually uses; blocks are retired when they reach a configured ceiling, while fresh blocks arrive with zero accumulated loss, allowing the workload to continue indefinitely if new data arrives fast enough. The second contribution is privacy-adaptive training, which repeatedly retrains a DP pipeline with more data and/or a larger privacy budget and validates via a DP 'SLAed' validator (ACCEPT/REJECT/RETRY) until a quality target is accepted. The paper proves block-composition theorems (Theorems 4.2 and 4.3), gives statistical and DP guarantees for the individual validators, and evaluates the system on NYC taxi and Criteo workloads.

Significance. The block-composition results are a genuine and, on my reading, technically sound contribution: Theorem 4.2 correctly reduces the privacy loss of queries on overlapping blocks to the maximum per-block loss, and Theorem 4.3 extends this to adaptively chosen blocks and privacy parameters on a stream, with the proof in Appendix A.2 correctly handling future blocks that depend on previous outputs through conditioning on the released values. The system design is thoughtful, and the evaluation is substantial (Q1–Q4, Tables 1–2, Figures 5–8). If the quality-control guarantee were fully established, this would be a strong systems paper on DP for ML workloads. However, the central 'with high probability' quality claim for privacy-adaptive training is currently unproven because of optional stopping, so the paper's second advertised contribution needs additional theoretical work.

major comments (2)
  1. [§3.3, Proposition 3.1 and §B.1] The paper's claim that privacy-adaptive training produces a model meeting the quality target with high probability is not supported by the stated propositions. Proposition 3.1 (restated as Proposition B.1) bounds the error of a single ACCEPT test for a fixed model: with probability at least 1−η, the test returns true only if L_D(f^dp)≤τ. The procedure in §3.3, however, runs this test repeatedly on newly trained models and stops at the first ACCEPT. The final index K is a stopping time that depends on the entire sequence of validation outcomes, so the event {ACCEPT_K and L_D(f_K)>τ} is contained in the union over t of {ACCEPT_t and L_D(f_t)>τ}; the per-attempt bound of η does not control this union (it is roughly E[K]η even under independence). The abstract's 'with high probability' quality criterion therefore has no proof. The empirical violation rates in Table 2, Section 5.2, are reassuring but do not close the gap because they do not report the retry-count distribution or apply a multiplicity correction. I recommend either proving a guarantee for the adaptive procedure (for example, by composing the tests with a union bound over a bounded number of attempts or by a sequential-testing argument) or revising the claims to state the guarantee per attempt only.
  2. [§3.3, Privacy-Adaptive Training paragraph] The resource-conservation argument ('the sum of budgets used by all failed iterations is at most equal to the budget used by the final, accepted iteration' and 'at most four times') is stated informally and is not a theorem. If the dataset window is also doubled on RETRY, old blocks are reused with increasing ε, and the cumulative per-block privacy loss across failed attempts plus the final attempt is what actually counts against the block ceiling; the claimed factor of four should be stated as a heuristic or proved with explicit accounting of both the ε doubling and the sample-size doubling. This does not affect the DP guarantee itself, but it is used to justify the Block/Conserve strategy in §5.4, so the claim should not be presented as a formal resource bound.
minor comments (4)
  1. [4.3 / Algorithm 4c] The condition in Theorem 4.3 is stated as a property of AccessControl for every block k; the proof would be easier to follow if it explicitly noted that for a fixed neighboring pair the changed block k is fixed and the other blocks contribute zero privacy loss, so the per-block guarantee suffices without a further union bound over blocks.
  2. [5.2, Table 2] Because the adaptive-stopping issue is open, the paper should report the distribution of the number of retries per accepted model (and ideally the maximum), so readers can assess the empirical multiplicity.
  3. [Appendix A.1] The discussion of symmetric difference notes that changing one record corresponds to a symmetric difference of size 2 and is supported only via group privacy; this should be stated in the main text when event-level privacy is defined, since many readers expect modification to be a neighboring relation.
  4. [References and typos] References [35] and [36] are duplicates; Appendix B.1 contains a typo ('more accuratly'); Section 3.3's resource-conservation paragraph should define precisely what 'budget used by an iteration' means.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the DP accounting theorem and the SLAed validation guarantees are derived from external composition theorems and concentration inequalities, with no fitted inputs or self-citation chain.

full rationale

I walked the claimed derivation chain and found no step that reduces to its own inputs by construction. Theorem 4.2 (Reduction to Block-level Composition) is an algebraic identity: for a neighboring pair differing only in block k, every query that does not use block k has identical output distributions on both worlds, so its privacy-loss factor is 1; the remaining loss is exactly the product over queries using block k. The theorem therefore does not assume the block-level bound; it derives it. Theorem 4.3 then combines this reduction with Rogers et al.'s composition result ([45]) and a union bound; the access-control condition (per-block sums bounded by epsilon_g and delta_g) is an explicit premise, and the (epsilon_g, delta_g)-DP conclusion is verified against Definition 2.1, so the global guarantee is not the same statement as the access-control rule. The SLAed validation (Proposition 3.1 / B.1) is a genuine concentration argument: DP-corrected counts and losses are bounded with Laplace tail bounds, and Bernstein's inequality bounds the expected loss; no parameter is fitted to the empirical violation rates in Section 5.2. I specifically considered the privacy-adaptive training loop's optional stopping. That is a possible correctness gap in the claimed 'with high probability' quality guarantee because Proposition 3.1 is stated for a single ACCEPT test and a multiplicity correction for retries is not given; but a missing proof for a sequential procedure is not circularity, because the per-attempt certificate is not defined in terms of the loop's success. I also checked the paper's citations: the load-bearing composition theorems and the Bernstein/Hoeffding inequalities are external prior work, and the paper's own authors are not cited for any load-bearing claim, so there is no self-citation chain. The trust boundary that developers must supply truly DP pipelines ('The developer is responsible for making this switch to DP') is an explicit assumption about the system's inputs, not a hidden reuse of the paper's conclusions. Finally, the block-composition idea is explicitly distinguished from PINQ's partition operator, which the paper says handles only non-overlapping partitions; this is an incremental theoretical claim rather than a renamed known result. Under the rule that only construction-level equivalences count as circularity, the derivation chain is self-contained and the appropriate score is 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The DP accounting theorem rests on standard composition results plus two trust assumptions: pipelines are truly DP, and future data is influenced by past releases only through DP outputs. The performance evaluation additionally depends on unreported workload-distribution parameters, which are listed as free parameters above but are not part of the theoretical guarantee.

free parameters (2)
  • Workload inter-arrival distribution = unspecified
    Figure 8 draws time between new pipelines from a Gamma distribution but no shape or scale parameters are reported; results depend on this choice.
  • Sample complexity distribution = unspecified
    The required sample size for each arriving pipeline is drawn from an unspecified power-law distribution, which controls release times in the Section 5.4 simulation.
assumptions (4)
  • standard math Standard composition theorems (basic composition [17], adaptive composition [45]) are correct.
    The block-composition proofs in Section 4 and Appendix A build directly on these external results.
  • domain assumption Every developer-supplied pipeline is (ε,δ)-DP as declared, including preprocessing, training, and validation.
    Sage only deducts budgets and does not inspect or verify pipeline code; stated in Section 3 ('The developer is responsible for making this switch to DP').
  • domain assumption The Laplace and Gaussian mechanisms used have privacy loss bounded by ε with probability at least 1-δ, so (ε,δ)-DP can be treated as a bounded-loss guarantee.
    This equivalence is not true for all DP mechanisms; the paper notes in A.1 that it holds for the mechanisms it uses.
  • domain assumption Future data blocks depend on past outputs only through DP-released models and an adversary-independent world W.
    Algorithm 4(c) line 6 encodes this; Theorem 4.3's stream extension requires it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy Accounting and Quality Control in the Sage Differentially Private ML Platform." pith.science (2026). https://pith.science/paper/QSGYYQRN

@misc{pith2026190901502,
  author       = {Pith},
  title        = {Pith review of: Privacy Accounting and Quality Control in the Sage Differentially Private ML Platform},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QSGYYQRN}},
  note         = {Machine review of arXiv:1909.01502}
}
read the original abstract

Companies increasingly expose machine learning (ML) models trained over sensitive user data to untrusted domains, such as end-user devices and wide-access model stores. We present Sage, a differentially private (DP) ML platform that bounds the cumulative leakage of training data through models. Sage builds upon the rich literature on DP ML algorithms and contributes pragmatic solutions to two of the most pressing systems challenges of global DP: running out of privacy budget and the privacy-utility tradeoff. To address the former, we develop block composition, a new privacy loss accounting method that leverages the growing database regime of ML workloads to keep training models endlessly on a sensitive data stream while enforcing a global DP guarantee for the stream. To address the latter, we develop privacy-adaptive training, a process that trains a model on growing amounts of data and/or with increasing privacy parameters until, with high probability, the model meets developer-configured quality criteria. They illustrate how a systems focus on characteristics of ML workloads enables pragmatic solutions that are not apparent when one focuses on individual algorithms, as most DP ML literature does.

Figures

Figures reproduced from arXiv: 1909.01502 by the authors.

Figure 1
Figure 1. Typical Architecture of an ML Platform. support for adaptivity and integrates well with TFX’s design, which includes a model validation stage in training pipelines. 2 Background Our effort builds upon an opportunity we observe in to￾day’s companies: the rise of ML platforms, trusted infrastruc￾tures that provide key services for ML workloads in produc￾tion, plus strong library support for their development. They can… view at source ↗
Figure 2
Figure 2. Sage DP ML Platform. Highlights changes from non-DP version. ML platform. First, each Training Pipeline must be made to individually satisfy (ϵ, δ)-DP for some privacy parameters given by Sage at runtime (box (ϵ, δ)-DP Training Pipeline, §3.1). The developer is responsible for making this switch to DP, and while research is needed to ease DP programming, this paper leaves that challenge aside. Second, Sage introduce… view at source ↗
Figure 3
Figure 3. Characteristics of Data Interaction in ML. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Interaction Protocols for Composition Analysis. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Impacts on TFX Training Pipelines. Impact of DP on the overall performance of training pipelines. 5a, and 5b show the MSE loss on the Taxi regression task (lower is better). 5c; 5d show the accuracy on the Criteo classification task (higher is better). The dotted lines…
Figure 6
Figure 6. Figure 6: Number of Samples Required to ACCEPT models at achievable quality targets. For MSE targets (Taxi regression 6a, and 6b) small targets are harder to achieve and require more samples. For accuracy targets (Criteo classification 6c, and 6d) high targets are harder and req…
Figure 7
Figure 7. Figure 7: Block-level vs. Query-level Accounting. Block-level query accounting provides benefits to model quality and validation. MSE better than 0.003 with block sizes of 500K, and 0.0044 for blocks of size 100K. Additionally, those targets that can be validated require signifi…
Figure 8
Figure 8. Figure 8: shows each strategy’s average model release time under increasing load (higher model arrival rate), as the sys￾tem enforces (ϵд, δд) = (1.0, 10−6 )-DP over the entire stream. We make two observations. First, Sage’s block composition is crucial. Query Composition and St…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 54 canonical work pages

  1. [45]

    R. M. Rogers, A. Roth, J. Ullman, and S. Vadhan. Privacy odometers and filters: Pay-as-you-go composition. In Proc. of the Conference on Neural Information Processing Systems (NeurIPS), 2016

    work page 2016

  2. [1]

    https://www.kaggle

    Kaggle display advertising challenge dataset. https://www.kaggle. com/c/criteo-display-ad-challenge , 2014

    work page 2014

  3. [2]

    Abadi, A

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Tal- war, and L. Zhang. Deep learning with differential privacy. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2016

    work page 2016

  4. [3]

    Backes, P

    M. Backes, P. Berrang, M. Humbert, and P. Manoharan. Membership privacy in microRNA-based studies. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2016

    work page 2016

  5. [4]

    Barak, K

    B. Barak, K. Chaudhuri, C. Dwork, S. Kale, F. McSherry, and K. Talwar. Privacy, accuracy, and consistency too: a holistic solution to contingency table release. In Proc. of the ACM SIGMOD International Conference on Management of Data, 2007

    work page 2007

  6. [5]

    Baylor, E

    D. Baylor, E. Breck, H.-T. Cheng, N. Fiedel, C. Y . Foo, Z. Haque, S. Haykal, M. Ispir, V . Jain, L. Koc, C. Y . Koo, L. Lew, C. Mewald, A. N. Modi, N. Polyzotis, S. Ramesh, S. Roy, S. E. Whang, M. Wicke, J. Wilkiewicz, X. Zhang, and M. Zinkevich. TFX: A Tensorflow- based production-scale machine learning platform. In Proc. of the International Conference...

    work page 2017

  7. [6]

    K. Boyd, E. Lantz, and D. Page. Differential privacy for classifier evaluation. In Proc. of the ACM Workshop on Artificial Intelligence and Security, 2015

    work page 2015

  8. [7]

    You Might Also Like:

    J. A. Calandrino, A. Kilzer, A. Narayanan, E. W. Felten, and V . Shmatikov. “You Might Also Like:” Privacy risks of collabora- tive filtering. In Proc. of IEEE Symposium on Security and Privacy (S&P), 2011

    work page 2011

Show all 59 references
  1. [8]

    Carlini, C

    N. Carlini, C. Liu, U. Erlingsson, J. Kos, and D. Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. arXiv:1802.08232, 2018

    2018 arXiv

  2. [9]

    T.-H. H. Chan, E. Shi, and D. Song. Private and continual release of statistics. ACM Transactions on Information Systems Security, 2011

    2011

  3. [10]

    Chaudhuri and C

    K. Chaudhuri and C. Monteleoni. Privacy-preserving logistic regression. In Proc. of the Conference on Neural Information Processing Systems (NeurIPS), 2008

    2008

  4. [11]

    Chaudhuri, A

    K. Chaudhuri, A. D. Sarwate, and K. Sinha. A near-optimal algorithm for differentially-private principal components. Journal of Machine Learning Research (JMLR), 14, 2013

    2013

  5. [12]

    Cummings, S

    R. Cummings, S. Krehbiel, K. A. Lai, and U. Tantipongpipat. Differ- ential privacy for growing databases. In Proc. of the Conference on Neural Information Processing Systems (NeurIPS), 2018

    2018

  6. [13]

    Dinur and K

    I. Dinur and K. Nissim. Revealing information while preserving privacy. In Proc. of the International Conference on Principles of Database Systems (PODS), 2003

    2003

  7. [14]

    Duchi and R

    J. Duchi and R. Rogers. Lower bounds for locally private estimation via communication complexity. arXiv:1902.00582, 2019

    1902 arXiv

  8. [15]

    J. C. Duchi, M. I. Jordan, and M. J. Wainwright. Minimax optimal procedures for locally private estimation. Journal of the American Statistical Association, 2018

    2018

  9. [16]

    C. Dwork. Differential privacy in new settings. In Proc. of the ACM Symposium on Discrete Algorithms (SODA), 2010

    2010

  10. [17]

    Dwork, F

    C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In Proc. of the Conference on Theory of Cryptography (TCC), 2006

    2006

  11. [18]

    Dwork, M

    C. Dwork, M. Naor, T. Pitassi, , and S. Yekhanin. Pan-private streaming algorithms. In Proc. of The Symposium on Innovations in Computer Science, 2010

    2010

  12. [19]

    Dwork, M

    C. Dwork, M. Naor, T. Pitassi, and G. N. Rothblum. Differential privacy under continual observation. In Proc. of the ACM Symposium on Theory of Computing (STOC), 2010

    2010

  13. [20]

    Dwork and A

    C. Dwork and A. Roth. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 2014

    2014

  14. [21]

    Dwork, G

    C. Dwork, G. N. Rothblum, and S. Vadhan. Boosting and differential privacy. In Proc. of the IEEE Symposium on Foundations of Computer Science (FOCS), 2010

    2010

  15. [22]

    Dwork, A

    C. Dwork, A. Smith, T. Steinke, and J. Ullman. Exposed! A survey of attacks on private data. Annual Review of Statistics and Its Application, 2017

    2017

  16. [23]

    Dwork, A

    C. Dwork, A. Smith, T. Steinke, J. Ullman, and S. Vadhan. Robust traceability from trace amounts. In Proc. of the IEEE Symposium on Foundations of Computer Science (FOCS), 2015

    2015

  17. [24]

    Hazelwood, S

    K. Hazelwood, S. Bird, D. Brooks, S. Chintala, U. Diril, D. Dzhulgakov, M. Fawzy, B. Jia, Y . Jia, A. Kalro, J. Law, K. Lee, J. Lu, P. Noordhuis, M. Smelyanskiy, L. Xiong, and X. Wang. Applied machine learning at Facebook: A datacenter infrastructure perspective. In Proc. of I...

    2018

  18. [25]

    Hoeffding

    W. Hoeffding. Probability inequalities for sums of bounded random variables. Journal of the American Statistical Association, 1963

    1963

  19. [26]

    Homer, S

    N. Homer, S. Szelinger, M. Redman, D. Duggan, W. Tembe, J. Muehling, J. V . Pearson, D. A. Stephan, S. F. Nelson, and D. W. Craig. Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microar- rays. PLoS Genetics, 2008

    2008

  20. [27]

    Jayaraman and D

    B. Jayaraman and D. Evans. Evaluating differentially private machine learning in practice. In Proc. of USENIX Security, 2019

    2019

  21. [28]

    Kairouz, S

    P. Kairouz, S. Oh, and P. Viswanath. The composition theorem for differential privacy. In International Conference on Machine Learning (ICML), 2015

    2015

  22. [29]

    S. P. Kasiviswanathan, H. K. Lee, K. Nissim, S. Raskhodnikova, and A. Smith. What can we learn privately? SIAM Journal on Computing, 2011

    2011

  23. [30]

    S. P. Kasiviswanathan and A. Smith. On the’semantics’ of differential privacy: A bayesian formulation. Journal of Privacy and Confidential- ity, 2014

    2014

  24. [31]

    Kifer, A

    D. Kifer, A. Smith, and A. Thakurta. Private convex empirical risk minimization and high-dimensional regression. In Proc. of the ACM Conference on Learning Theory (COLT), 2012

    2012

  25. [32]

    Leonard and C

    N. Leonard and C. M. Halasz. Twitter meets tensorflow. https://blog.twitter.com/engineering/en_us/topics/insights/ 2018/twittertensorflow.html, 2018

    2018

  26. [33]

    L. E. Li, E. Chen, J. Hermann, P. Zhang, and L. Wang. Scaling machine learning as a service. In Proc. of The International Conference on Predictive Applications and APIs, 2017

    2017

  27. [34]

    Maurer and M

    A. Maurer and M. Pontil. Empirical Bernstein Bounds and Sample Variance Penalization. 2009

    2009

  28. [36]

    H. B. McMahan and G. Andrew. A general approach to adding dif- ferential privacy to iterative training procedures. arXiv:1812.06210, 2018

    2018 arXiv

  29. [37]

    H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang. Learning differ- entially private recurrent language models. In Proc. of the International Conference on Learning Representations (ICLR), 2018

    2018

  30. [38]

    McSherry and I

    F. McSherry and I. Mironov. Differentially private recommender sys- tems: Building privacy into the Netflix prize contenders. In Proc. of the International Conference on Knowledge Discovery and Data Mining (KDD), 2009

    2009

  31. [39]

    F. D. McSherry. Privacy integrated queries: An extensible platform for privacy-preserving data analysis. In Proc. of the ACM SIGMOD International Conference on Management of Data, 2009

    2009

  32. [40]

    Mohan, A

    P. Mohan, A. Thakurta, E. Shi, D. Song, and D. Culler. GUPT: Privacy preserving data analysis made easy. InProc. of the 2012 ACM SIGMOD International Conference on Management of Data, 2012

    2012

  33. [41]

    Nikolaenko, U

    V . Nikolaenko, U. Weinsberg, S. Ioannidis, M. Joye, D. Boneh, and N. Taft. Privacy-preserving ridge regression on hundreds of millions of records. In Proc. of IEEE Symposium on Security and Privacy (S&P), 2013

    2013

  34. [42]

    http://www

    NYC Taxi & Limousine Commission - trip record data. http://www. nyc.gov/html/tlc/html/about/trip_record_data.shtml, 2018

    2018

  35. [43]

    Proserpio, S

    D. Proserpio, S. Goldberg, and F. McSherry. Calibrating data to sen- sitivity in private data analysis: a platform for differentially-private analysis of weighted datasets. Proc. of the International Conference on Very Large Data Bases (VLDB), 2014

    2014

  36. [44]

    S. Ravi. On-device machine intelligence. https://ai.googleblog.com/ 2017/02/on-device-machine-intelligence.html , 2017

    2017

  37. [46]

    I. Roy, S. T. Setty, A. Kilzer, V . Shmatikov, and E. Witchel. Airavat: Se- curity and privacy for MapReduce. In Proc. of the USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2010

    2010

  38. [47]

    Shalev-Shwartz and S

    S. Shalev-Shwartz and S. Ben-David. Understanding Machine Learn- ing: From Theory to Algorithms. Appendix B. Cambridge University Press, New York, NY , USA, 2014. 14

    2014

  39. [48]

    Shiebler and A

    D. Shiebler and A. Tayal. Making machine learning easy with embed- dings. SysML http://www.sysml.cc/doc/115.pdf, 2010

    2010

  40. [49]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Membership inference attacks against machine learning models. In Proc. of IEEE Symposium on Security and Privacy (S&P), 2017

    2017

  41. [50]

    Smith and A

    A. Smith and A. Thakurta. Differentially private model selection via stability arguments and the robustness of lasso. Journal of Machine Learning Research, 2013

    2013

  42. [51]

    Talwar, A

    K. Talwar, A. Thakurta, and L. Zhang. Nearly-optimal private LASSO. In Proc. of the Conference on Neural Information Processing Systems (NeurIPS), 2015

    2015

  43. [52]

    Tramèr, F

    F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart. Stealing machine learning models via prediction apis. In Proc. of USENIX Security, 2016

    2016

  44. [53]

    Y .-X. Wang. Revisiting differentially private linear regression: op- timal and adaptive prediction & estimation in unbounded domain. arXiv:1803.02596, 2018

    2018 arXiv

  45. [54]

    J. Xu, Z. Zhang, X. Xiao, Y . Yang, G. Yu, and M. Winslett. Differen- tially private histogram publication. In Proc. of the IEEE International Conference on Data Engineering (ICDE), 2012

    2012

  46. [55]

    L. Yu, L. Liu, C. Pu, M. E. Gursoy, and S. Truex. Differentially private model publishing for deep learning. In Proc. of IEEE Symposium on Security and Privacy (S&P), 2019

    2019

  47. [56]

    Zhang, R

    D. Zhang, R. McKenna, I. Kotsogiannis, M. Hay, A. Machanavajjhala, and G. Miklau. Ektelo: A framework for defining differentially-private computations. In Proc. of the ACM SIGMOD International Conference on Management of Data, 2018

    2018

  48. [57]

    Zhang, Z

    J. Zhang, Z. Zhang, X. Xiao, Y . Yang, and M. Winslett. Functional mechanism: Regression analysis under differential privacy. In Proc. of the International Conference on Very Large Data Bases (VLDB), 2012. A Block Composition This section makes several clarifications and preci...

    2012

  49. [58]

    2): ndp te = nte + Laplace( 2 ϵ)− 2 ϵ ln( 3 2η)

    (Lines 11-13 List. 2): ndp te = nte + Laplace( 2 ϵ)− 2 ϵ ln( 3 2η). 16 Then, compute a DP estimate of the loss corrected for DP impact (Lines 14-17 List. 2) to be an upper bound on the true value,Lt e(f dp) ≜ 1 nte Í t e l(f dp, x,y), with probability (1− η 3): L dp t e(f dp) ...

  50. [59]

    2): ndp tr = ntr + Laplace( 2 ϵ), ndp tr = ndp tr − 2 ϵ ln( 3 η), ndp tr = ndp tr + 2 ϵ ln( 3 η)

    (Lines 24-27 List. 2): ndp tr = ntr + Laplace( 2 ϵ), ndp tr = ndp tr − 2 ϵ ln( 3 η), ndp tr = ndp tr + 2 ϵ ln( 3 η). Then, we compute a DP estimate of the loss corrected for DP impact (Lines 14-17 List. 2) to be a lower bound on the true value with probability(1− η 3): Ldp t e...

  51. [60]

    will be better and are directly applicable). Compute: ndp tr = ntr + Laplace( 2 ϵ)− 2 ϵ ln( 2 η) SageACCEPT s if: 1 ndp tr 2 ϵ ln( 2 η) + B s ln(2/η) ndp tr ≤τer r , in which case the absolute error is bellowτer r with probability at least(1−η), accounting for the statistical ...

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.