REVIEW 4 major objections 6 minor 40 references
Machine Learning with Privacy for Protected Attributes
T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read Feature differential privacy protects only designated private attributes and, through a two-batch SGD variant, restores subsampling amplification so the same privacy budget yields far better utility than full-sample DP.
desk verdict A solid new privacy definition with real algorithmic payoff, but the empirical significance is anchored on public features the authors themselves disclaim. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the two-batch noisy SGD construction (Algorithm 1), driven by a feature-dependent split of the loss: write \(\ell(x,\$\theta$) = \ell_{\mathrm{priv}}(x,\$\theta$) + \ell_{\mathrm{pub}}(\Psi(x),\$\theta$)\), where \(\ell_{\mathrm{pub}}\) is a surrogate loss that predicts the true loss from the public feature alone. Each iteration samples a Poisson mini-batch for the private residual gradient and an independent uniform batch for the public gradient; keeping the two batches independent is what preserves the randomness of the sub-sampling coins and restores amplification. The privacy analysis reduces one step to a subsampled Gaussian mechanism with noise multiplier \(\$\sigma$/\tau\), and the product-composition object \(f = T\big(N(0,\$\sigma$)^T, ((1-p)N(0,\$\sigma$)+pN(\tau,\$\sigma$))^T\big)\) is the exact f-DP trade-off that converts into \((\epsilon,\delta)\) parameters. This machinery makes the noise scale depend on the private loss's Lipschitz constant \(\tau\) rather than the full loss's \(\tau'\).
What would settle it
Run the AFHQ blurred-image setup and launch an attribute-inference or face re-identification attack that uses only the blurred public features against a model trained under FDP; if the attacker's success exceeds the \(1-f(\mathrm{Ball})\) bound from Theorem 4, or matches the success of an attacker who never sees the model, the feature map fails to separate public from private information and the practical privacy claim collapses. A separate check for the privacy theorem itself: for a small logistic-regression instance, compute the empirical trade-off between the two gradient distributions in Theorem 5 and compare it with the claimed \(f\); any violation would refute the proof.
Extended reading notes
Core claim
The paper establishes that feature differential privacy can be algorithmic rather than purely definitional. Definition 5 fixes a public feature map \(\Psi\) and requires indistinguishability only between neighboring datasets whose differing points share the same value of \(\Psi\); a simulation-based insertion/deletion variant (Definition 6) extends the same idea to add/remove adjacency. The main technical discovery is that subsampling amplification, which fails for a naive feature-DP mechanism (Proposition 3), can be recovered by splitting each SGD step into two independent batches: one computes the public-gradient component from \(\Psi\), the other computes the private residual gradient. Theorem 5 shows the resulting algorithm is \(f\)-DP\(^{\Psi}_i\) with trade-off function \(f = T\big(N(0,\$\sigma$)^T, ((1-p)N(0,\$\sigma$)+pN(\tau,\$\sigma$))^T\big)\), where \(\tau\) is the Lipschitz constant of the private residual loss. Since \(\tau \le \tau'\), the full loss's Lipschitz constant, the Gaussian noise needed for an \((\epsilon,\delta)\) guarantee is smaller than in standard DP-SGD, yielding lower excess risk (Theorem 6) and, in the label-DP special case, an \(O(d/(\$epsilon^{2}$ |S|^2))\) excess-risk bound that answers an open question in the label-DP literature.
Load-bearing premise
The guarantee is only as strong as the public-feature map: if the 'public' part still contains identifying or sensitive information, then feature-DP does not bound membership inference or full-sample reconstruction, even though every theorem in the analysis remains true.
Editorial extensions
If this is right
- For a fixed \((\epsilon,\delta)\) budget, feature-DP training can use a smaller noise scale than full-sample DP whenever the private residual loss is less sensitive than the full loss, with the gain inherited directly by the excess-risk bounds.
- Label DP is a special case of FDP; the paper's \(O(d/(\epsilon^2 |S|^2))\) excess-risk bound beats the earlier dataset-size-independent bound once \(|S| > \sqrt{d/k}\).
- FDP satisfies adaptive composition and post-processing, and arbitrarily many public pre-training steps can be run before Algorithm 1 without spending any of the privacy budget (Remark 2).
- Attribute inference on private features is controlled by \(1-f(\mathrm{Ball})\), so an attacker's success is bounded by a geometric concentration term together with the privacy trade-off function.
- The empirical results on AFHQ and LSUN show that FDP training of diffusion models produces recognizable outputs at privacy levels where standard DP training fails, with FID 101.9 versus 286.7 at \(\epsilon=8\) on AFHQ.
Reading between the lines
- Inference: the two-batch decomposition should transfer to any loss that can be split into a public prediction and a private residual, so FDP could be combined with external public pretraining or foundation-model priors, a direction the paper only touches.
- Inference: because the formal guarantee is relative to an arbitrary \(\Psi\), deployments should audit the chosen feature map against re-identification; the paper's own caution that blurred faces may still be identifying implies that the empirical FID gains do not by themselves certify privacy.
- Inference: a natural next step is to learn \(\Psi\) and \(\ell_{\mathrm{pub}}\) jointly rather than choosing them by hand, with the FDP bound used as a constraint during training; the theory gives no direct guidance on how to optimize the public/private split.
- Inference: the utility gain is largest when the public feature carries most of the predictive signal, so the framework is likely to help most in structured data such as images and least in settings like Criteo, where public and private features contribute comparably.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces feature differential privacy (FDP), a relaxation of differential privacy that protects only a chosen feature map Ψ of each record rather than the whole record. It defines replacement and insertion/deletion variants (Definitions 5 and 6, the latter simulation-based), proves composition (Theorem 3), an attribute-inference bound (Theorem 4), and presents a two-batch DP-SGD variant (Algorithm 1) claimed to satisfy FDP while benefiting from subsampling amplification (Theorem 5), with convex excess-risk bounds (Theorem 6) and a label-DP case study that answers an open question of Ghazi et al. Experiments on Purchase100, Criteo, AFHQ, and LSUN report utility gains over standard DP, including a large FID improvement on AFHQ when blurred images are treated as public features.
Significance. If the proofs are completed, FDP is a valuable formal framework for partial privacy: it composes, supports both replacement and insertion/deletion semantics, and gives a principled bound on attribute-inference attacks. The two-batch construction in Algorithm 1 is a genuine attempt to combine a public-feature loss with a private loss while preserving subsampling amplification, and the label-DP excess-risk bound scaling as O(d/(ε^2|S|^2)) addresses a concrete open problem. Theorem 4's attribute-inference bound cleanly quantifies residual reconstruction risk in terms of the geometric concentration measure Ball. The paper is also candid about the dependence of the guarantee on the user-supplied feature map Ψ, which is both a strength and a source of limitation for the empirical claims.
major comments (4)
- [Appendix: Proof of Theorem 5 (Algorithm 2)] The proof of the insertion/deletion variant of Theorem 5 is incomplete. Definition 6 requires both Pr[M(S')∈T] ≤ 1−f(Pr[sim(S,u)∈T]) and the reverse inequality. The appendix constructs the simulator in Algorithm 2 and derives only the first inequality; the reverse does not follow from the same dominating pair because the trade-off function T(N(0,σ), (1−p)N(0,σ)+pN(τ,σ)) is not symmetric. In addition, the proof does not account for different subsampling probabilities in the mechanism and the simulator: Algorithm 1 uses p=m/|S|, so the mechanism on S' (size n+1) uses p_mech=m/(n+1) while the simulator on S (size n) uses p_sim=m/n. These two gaps leave the main algorithmic privacy theorem unproven as written.
- [Section 5, Algorithm 1 and Theorem 5] Theorem 5's trade-off function and noise schedule appear to analyze a sum query, not the averaged private gradient computed in Algorithm 1. Line 4 defines gpriv_t = (1/m) Σ_{x∈Bpriv_t} ∇ℓpriv(wt;x), so the per-example contribution to the output is (1/m)∇ℓpriv, and the shift in the subsampled Gaussian trade-off should be τ/m rather than τ. The proof in the appendix writes Ci = Ai + ∇ℓpriv(wt;x) without the 1/m factor. Consequently, the stated schedule σ = cτm/(ε·n)√(T log(1/δ) log(T/δ)) does not follow from the stated f, and the utility claims in Theorem 6 that depend on σ are not justified as written.
- [Appendix: Proof of Proposition 3] The proof of Proposition 3 is cut off. After defining q1,...,q4, the tightness argument stops and the text moves to 'Proof of Theorem 4'. The claim that the randomized-response mechanism is tightly (ϵ,0)-DPΨ_i for all p is therefore unverified. Since Proposition 3 is the stated reason that a naive feature-DP adaptation does not benefit from subsampling, this missing argument should be supplied or the proposition should be clearly labeled as a conjecture.
- [Section 4 and Section 6.3] The empirical public features are explicitly disclaimed by the paper. Section 4 states 'the public feature can be used for identification... feature DP would not necessarily provide upper bounds on membership inference attacks' and 'We do not recommend using the public features that we use in our empirical studies in the paper.' The abstract nevertheless highlights the AFHQ result (FID 286.7 to 101.9 at ε=8) based on blurring as the public feature, which is the kind of feature the paper warns may leak private identity information. Without a certification method for Ψ, the experimental demonstrations do not establish that FDP yields practical privacy-preserving utility; they only illustrate the algorithm under an unvalidated public-feature assumption. This should be stated plainly where the results are presented.
minor comments (6)
- [Section 5, Theorem 6] The excess-risk bound is misparenthesized: '≤ (M2 c +cτ′2 +cdσ2)2 + log(T )√ T' should presumably read '(M^2/c + cτ'^2 + c d σ^2)(2 + log T)/√T' or similar; please fix the formula.
- [Appendix: Proof of Theorem 5] In the sentence 'the hockey-stick divergence between Xi and Yi is bounded by that of N(0,σ^2) and (1−p)N(0,σ^2)+pN(0,σ^2)' the last term should be pN(τ,σ^2) or pN(L,σ^2); as written it is a typo. Also L is used without definition.
- [Section 6.2] The experimental description for Purchase100 diverges from Algorithm 1: the paper computes ~gpub = gpub + N(0,C^2σ^2) and then aggregates with α, whereas Algorithm 1 adds the noise to the total gradient and has no α. Please clarify which procedure is actually used.
- [Section 6.1] For Purchase100, the text says 100 features plus the label are public, but later states 'leaking 100 features from the set of 600 features' without mentioning the label; please make the description consistent.
- [Section 1 and Figure 1] The figure caption 'Private image and its public variant' would benefit from specifying that the public variant is a blurred version; the exact blur parameters for AFHQ and LSUN are not given in Section 6.3.
- [Appendix A (Meta-Review)] The appendix reproduces the S&P meta-review, which is not appropriate for a journal submission; please remove it or clearly separate it from the technical content.
Circularity Check
No load-bearing circularity: FDP theorems derive from definitions plus standard f-DP/subsampling results; the dependence on the choice of Ψ is an acknowledged limitation, not a circular step.
full rationale
The derivation chain is not circular. Definition 5 fixes feature DP relative to a user-chosen Ψ, and Definition 6 adds the simulation-based insertion/deletion variant. Theorem 5's privacy guarantee is proved by constructing Algorithm 2 as a simulator and bounding the hockey-stick divergence between real and simulated per-step gradient distributions using the standard subsampled Gaussian result (Balle et al., Thm 4 in [2]) and f-DP composition (Dong–Roth–Su). The trade-off function f in Theorem 5 is literally the trade-off of a p-subsampled Gaussian with sensitivity τ; it is not a quantity fitted to the output or defined in terms of the conclusion. Theorem 6 applies standard SGD convergence bounds to an unbiased gradient estimator; the improvement over DP-SGD follows from the definitional fact that the public-loss gradient g_pub is not private, so the noise scale can depend on τ rather than τ′. The label-DP case study derives a new O(d/(ε²|S|²)) bound from the same subsampling analysis; it does not presuppose or rename Ghazi et al.'s result. The experiments demonstrate the intended utility gain from leaking chosen public features; no experimental result is fed back into a theorem as a fitted parameter. The paper's own warnings that an unsafe Ψ can make FDP vacuous—'feature DP would not necessarily provide upper bounds on membership inference attacks' and 'We do not recommend using the public features that we use in our empirical studies'—are limitations on how to instantiate Ψ, not circular reductions: the theorems remain true relative to any Ψ, and the vacuousness arises from a poor choice of Ψ, not from the proof relying on its conclusion. References overlapping with the authors (e.g., [17], [24], [32]) are contextual or point to independent prior results; none is load-bearing for the central FDP claim.
Assumptions & free parameters
free parameters (4)
- aggregation ratio alpha (Purchase100) =
tuned per run
- clipping threshold C =
0.01 (Purchase100), 0.1 (diffusion)
- noise multiplier sigma =
1.0 (Purchase100), 0.86 (AFHQ), 15.6 (LSUN)
- batch sizes m and m-prime =
e.g., 1,024 to 8,000 for Criteo; 128 for AFHQ; 16,384 for LSUN
assumptions (4)
- standard math Standard definitions and theorems of f-DP, Gaussian DP, and subsampling amplification are accepted as background (Dong et al. 2019; Balle et al. 2018).
- domain assumption The feature map Psi is fixed, publicly known, and the adversary knows Psi(x) for every sample; the FDP guarantee is relative to this map.
- domain assumption The private loss l_priv is tau-Lipschitz (or its per-sample gradient norm is bounded by tau), and the public loss l_pub depends only on Psi and reveals nothing about private features.
- ad hoc to paper For the utility advantage, a public loss l_pub can be constructed so that l_priv has a much smaller Lipschitz constant than the full loss l.
Cite this review
Pith. "Pith review of Machine Learning with Privacy for Protected Attributes." pith.science (2026). https://pith.science/paper/REMMV3FV
@misc{pith2026250619836,
author = {Pith},
title = {Pith review of: Machine Learning with Privacy for Protected Attributes},
year = {2026},
howpublished = {\url{https://pith.science/paper/REMMV3FV}},
note = {Machine review of arXiv:2506.19836}
}
abstract
Differential privacy (DP) has become the standard for private data analysis. Certain machine learning applications only require privacy protection for specific protected attributes. Using naive variants of differential privacy in such use cases can result in unnecessary degradation of utility. In this work, we refine the definition of DP to create a more general and flexible framework that we call feature differential privacy (FDP). Our definition is simulation-based and allows for both addition/removal and replacement variants of privacy, and can handle arbitrary and adaptive separation of protected and non-protected features. We prove the properties of FDP, such as adaptive composition, and demonstrate its implications for limiting attribute inference attacks. We also propose a modification of the standard DP-SGD algorithm that satisfies FDP while leveraging desirable properties such as amplification via sub-sampling. We apply our framework to various machine learning tasks and show that it can significantly improve the utility of DP-trained models when public features are available. For example, we train diffusion models on the AFHQ dataset of animal faces and observe a drastic improvement in FID compared to DP, from 286.7 to 101.9 at $\epsilon=8$, assuming that the blurred version of a training image is available as a public feature. Overall, our work provides a new approach to private data analysis that can help reduce the utility cost of DP while still providing strong privacy guarantees.
Figures
Figures from the paper (3 more)
Reference graph
Works this paper leans on
-
[1]
Deep learning with differential privacy
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016
2016
-
[2]
Pri- vacy amplification by subsampling: Tight analyses via couplings and divergences
Borja Balle, Gilles Barthe, and Marco Gaboardi. Pri- vacy amplification by subsampling: Tight analyses via couplings and divergences. Advances in Neural Infor- mation Processing Systems , 31, 2018
work page 2018
-
[3]
Private stochastic convex optimization with optimal rates
Raef Bassily, Vitaly Feldman, Kunal Talwar, and Abhradeep Guha Thakurta. Private stochastic convex optimization with optimal rates. Advances in neural information processing systems , 32, 2019
work page 2019
-
[4]
Broadening the scope of differential privacy using metrics
Konstantinos Chatzikokolakis, Miguel E Andrés, Nicolás Emilio Bordenabe, and Catuscia Palamidessi. Broadening the scope of differential privacy using metrics. In Privacy Enhancing Technologies: 13th International Symposium, PETS 2013, Bloomington, IN, USA, July 10-12, 2013. Proceedings 13 , pages 82–
work page 2013
-
[5]
On the relationships between no- tions of simulation-based security
Anupam Datta, Ralf Küsters, John C Mitchell, and Ajith Ramanathan. On the relationships between no- tions of simulation-based security. In Theory of Cryp- tography Conference, pages 476–494. Springer, 2005
work page 2005
-
[6]
Unlocking high-accuracy differentially private image classification through scale
Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlocking high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204.13650 , 2022
arXiv 2022
-
[7]
Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. arXiv preprint arXiv:1905.02383 , 2019
arXiv 1905
-
[8]
Cynthia Dwork. Differential privacy. ICALP’06 Pro- ceedings of the 33rd international conference on Au- tomata, Languages and Programming - Volume Part II, 2006
work page 2006
Show all 40 references
-
[9]
Why is public pretraining necessary for private model training? In Interna- tional Conference on Machine Learning, pages 10611– 10627
Arun Ganesh, Mahdi Haghifam, Milad Nasr, Sewoong Oh, Thomas Steinke, Om Thakkar, Abhradeep Guha Thakurta, and Lun Wang. Why is public pretraining necessary for private model training? In Interna- tional Conference on Machine Learning, pages 10611– 10627. PMLR, 2023
2023
-
[10]
Property inference attacks on fully connected neural networks using permutation invariant representations
Karan Ganju, Qi Wang, Wei Yang, Carl A Gunter, and Nikita Borisov. Property inference attacks on fully connected neural networks using permutation invariant representations. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 619–633, 2018
2018
-
[11]
Dif- ferentially private diffusion models generate useful synthetic images
Sahra Ghalebikesabi, Leonard Berrada, Sven Gowal, Ira Ktena, Robert Stanforth, Jamie Hayes, Soham De, Samuel L Smith, Olivia Wiles, and Borja Balle. Dif- ferentially private diffusion models generate useful synthetic images. arXiv preprint arXiv:2302.13861 , 2023
2023 arXiv
-
[12]
Deep learning with label differential privacy
Badih Ghazi, Noah Golowich, Ravi Kumar, Pasin Ma- nurangsi, and Chiyuan Zhang. Deep learning with label differential privacy. Advances in neural information processing systems, 34:27131–27145, 2021
2021
-
[13]
Algorithms with more granu- lar differential privacy guarantees
Badih Ghazi, Ravi Kumar, Pasin Manurangsi, and Thomas Steinke. Algorithms with more granu- lar differential privacy guarantees. arXiv preprint arXiv:2209.04053, 2022
2022 arXiv
-
[14]
Inferential privacy guarantees for differentially private mechanisms
Arpita Ghosh and Robert Kleinberg. Inferential privacy guarantees for differentially private mechanisms. arXiv preprint arXiv:1603.01508, 2016
2016 arXiv
-
[15]
Numerical composition of differential privacy
Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. Numerical composition of differential privacy. Ad- vances in Neural Information Processing Systems , 34:11631–11642, 2021
2021
-
[16]
Bounding training data re- construction in private (deep) learning
Chuan Guo, Brian Karrer, Kamalika Chaudhuri, and Laurens van der Maaten. Bounding training data re- construction in private (deep) learning. In International Conference on Machine Learning , pages 8056–8071. PMLR, 2022
2022
-
[17]
Bounding training data reconstruction in dp-sgd
Jamie Hayes, Borja Balle, and Saeed Mahloujifar. Bounding training data reconstruction in dp-sgd. Ad- vances in Neural Information Processing Systems , 36, 2024
2024
-
[18]
Are attribute inference attacks just imputation? In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 1569–1582, 2022
Bargav Jayaraman and David Evans. Are attribute inference attacks just imputation? In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 1569–1582, 2022
2022
-
[19]
{AttriGuard}: A practical defense against attribute inference attacks via adversarial machine learning
Jinyuan Jia and Neil Zhenqiang Gong. {AttriGuard}: A practical defense against attribute inference attacks via adversarial machine learning. In 27th USENIX Security Symposium (USENIX Security 18), pages 513– 529, 2018
2018
-
[20]
Private convex empirical risk minimization and high- dimensional regression
Daniel Kifer, Adam Smith, and Abhradeep Thakurta. Private convex empirical risk minimization and high- dimensional regression. In Conference on Learning Theory, pages 25–1. JMLR Workshop and Conference Proceedings, 2012
2012
-
[21]
Private learning with public features
Walid Krichene, Nicolas Mayoraz, Steffen Rendle, Shuang Song, Abhradeep Thakurta, and Li Zhang. Private learning with public features. arXiv preprint arXiv:2310.15454, 2023
2023 arXiv
-
[22]
Large language models can be strong differentially private learners
Xuechen Li, Florian Tramer, Percy Liang, and Tat- sunori Hashimoto. Large language models can be strong differentially private learners. arXiv preprint arXiv:2110.05679, 2021
2021 arXiv
-
[23]
Distributional privacy for data sharing
Zinan Lin, Shuaiqi Wang, Vyas Sekar, and Giulia Fanti. Distributional privacy for data sharing. In NeurIPS 2022 Workshop on Synthetic Data for Em- powering ML Research , 2022
2022
-
[24]
Property inference from poisoning
Saeed Mahloujifar, Esha Ghosh, and Melissa Chase. Property inference from poisoning. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1120–
2022
-
[25]
Antipodes of label differential privacy: Pate and alibi
Mani Malek Esmaeili, Ilya Mironov, Karthik Prasad, Igor Shilov, and Florian Tramer. Antipodes of label differential privacy: Pate and alibi. Advances in Neural Information Processing Systems, 34:6934–6945, 2021
2021
-
[26]
Not all features are equal: Discovering essential features for preserving prediction privacy
Fatemehsadat Mireshghallah, Mohammadkazem Taram, Ali Jalali, Ahmed Taha Taha Elthakeb, Dean Tullsen, and Hadi Esmaeilzadeh. Not all features are equal: Discovering essential features for preserving prediction privacy. In Proceedings of the Web Conference 2021, pages 669–680, 2021
2021
-
[27]
Stochastic gradient descent for non-smooth optimization: Convergence re- sults and optimal averaging schemes
Ohad Shamir and Tong Zhang. Stochastic gradient descent for non-smooth optimization: Convergence re- sults and optimal averaging schemes. In International conference on machine learning, pages 71–79. PMLR, 2013
2013
-
[28]
Selective differential privacy for language model- ing
Weiyan Shi, Aiqi Cui, Evan Li, Ruoxi Jia, and Zhou Yu. Selective differential privacy for language model- ing. arXiv preprint arXiv:2108.12944 , 2021
2021 arXiv
-
[29]
Stochastic gradient descent with differentially private updates
Shuang Song, Kamalika Chaudhuri, and Anand D Sar- wate. Stochastic gradient descent with differentially private updates. In 2013 IEEE global conference on signal and information processing , pages 245–248. IEEE, 2013
2013
-
[30]
Machine learning with differentially private labels: Mechanisms and frameworks
Xinyu Tang, Milad Nasr, Saeed Mahloujifar, Virat She- jwalkar, Liwei Song, Amir Houmansadr, and Prateek Mittal. Machine learning with differentially private labels: Mechanisms and frameworks. Proceedings on Privacy Enhancing Technologies, 4:332–350, 2022
2022
-
[31]
Analytical composition of differential privacy via the edgeworth accountant
Hua Wang, Sheng Gao, Huanyu Zhang, Milan Shen, and Weijie J Su. Analytical composition of differential privacy via the edgeworth accountant. arXiv preprint arXiv:2206.04236, 2022
2022 arXiv
-
[32]
A randomized ap- proach for tight privacy accounting
Jiachen T Wang, Saeed Mahloujifar, Tong Wu, Ruoxi Jia, and Prateek Mittal. A randomized ap- proach for tight privacy accounting. arXiv preprint arXiv:2304.07927, 2023
2023 arXiv
-
[33]
A study of face obfuscation in imagenet
Kaiyu Yang, Jacqueline H Yau, Li Fei-Fei, Jia Deng, and Olga Russakovsky. A study of face obfuscation in imagenet. In International Conference on Machine Learning, pages 25313–25330. PMLR, 2022
2022
-
[34]
Vip: A differentially private foundation model for computer vision
Yaodong Yu, Maziar Sanjabi, Yi Ma, Kamalika Chaud- huri, and Chuan Guo. Vip: A differentially private foundation model for computer vision. arXiv preprint arXiv:2306.08842, 2023
2023 arXiv
-
[35]
Attribute privacy: Framework and mechanisms
Wanrong Zhang, Olga Ohrimenko, and Rachel Cum- mings. Attribute privacy: Framework and mechanisms. In Proceedings of the 2022 ACM Conference on Fair- ness, Accountability, and Transparency , pages 757– 766, 2022
2022
-
[36]
Opti- mal accounting of differential privacy via characteristic function
Yuqing Zhu, Jinshuo Dong, and Yu-Xiang Wang. Opti- mal accounting of differential privacy via characteristic function. In International Conference on Artificial Intelligence and Statistics , pages 4782–4817. PMLR, 2022. Proofs Proof of Proposition 1. We prove this for f(x) =eϵ...
2022
-
[37]
Feature Differential Privacy
The notion of “Feature Differential Privacy” is novel, which protects against attribute inference attacks
-
[38]
This paper extends DP-SGD algorithm to satisfy feature DP, and shows that feature DP can achieve better utility guarantees than approximate DP
-
[39]
This paper allows one to selectively decide which features to protect. A.4. Noteworthy Concerns
-
[40]
Accuracy gains on the Criteo dataset is relatively small
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.