Gaussian Differential Privacy
read the original abstract
Differential privacy has seen remarkable success as a rigorous and practical formalization of data privacy in the past decade. This privacy definition and its divergence based relaxations, however, have several acknowledged weaknesses, either in handling composition of private algorithms or in analyzing important primitives like privacy amplification by subsampling. Inspired by the hypothesis testing formulation of privacy, this paper proposes a new relaxation, which we term `$f$-differential privacy' ($f$-DP). This notion of privacy has a number of appealing properties and, in particular, avoids difficulties associated with divergence based relaxations. First, $f$-DP preserves the hypothesis testing interpretation. In addition, $f$-DP allows for lossless reasoning about composition in an algebraic fashion. Moreover, we provide a powerful technique to import existing results proven for original DP to $f$-DP and, as an application, obtain a simple subsampling theorem for $f$-DP. In addition to the above findings, we introduce a canonical single-parameter family of privacy notions within the $f$-DP class that is referred to as `Gaussian differential privacy' (GDP), defined based on testing two shifted Gaussians. GDP is focal among the $f$-DP class because of a central limit theorem we prove. More precisely, the privacy guarantees of \emph{any} hypothesis testing based definition of privacy (including original DP) converges to GDP in the limit under composition. The CLT also yields a computationally inexpensive tool for analyzing the exact composition of private algorithms. Taken together, this collection of attractive properties render $f$-DP a mathematically coherent, analytically tractable, and versatile framework for private data analysis. Finally, we demonstrate the use of the tools we develop by giving an improved privacy analysis of noisy stochastic gradient descent.
This paper has not been read by Pith yet.
Forward citations
Cited by 7 Pith papers
-
Auditing Apple's DifferentialPrivacy.framework: Implementation Bugs, Misconfigurations, and Practical Risks
Audit finds DP violations in 5 of 9 mechanisms in Apple's framework due to insecure floating-point samplers and disabled local DP in secure aggregation, impacting 87% of macOS Sonoma and 68% of Sequoia data collection.
-
Optimal Guarantees for Auditing R\'enyi Differentially Private Machine Learning
A hypothesis-testing framework with class-restricted Donsker-Varadhan estimators provides optimal non-asymptotic confidence intervals and minimax lower bounds for black-box auditing of Rényi DP guarantees.
-
Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy
A new framework is introduced for end-to-end provable robustness against backdoor attacks by composing randomized smoothing with differentially private training via privacy profiles.
-
Auditing Apple's DifferentialPrivacy.framework: Implementation Bugs, Misconfigurations, and Practical Risks
Client-side audit of Apple's closed-source DP framework finds floating-point sampler bugs and misconfigurations that violate DP guarantees in 5 of 9 mechanisms, affecting 87% of data collection on Sonoma and 68% on Sequoia.
-
Rethinking the Security of DP-SGD: A Corrected Analysis of Differentially Private Machine Learning
DP-SGD with expected or batch averaging (EASGM or ASGM) has weaker privacy guarantees than the standard subsampled Gaussian mechanism analysis, confirmed by theoretical re-analysis and audits of libraries including Opacus.
-
Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD
Shuffled DP-SGD requires σ ≥ 1/√(2 ln M) or κ ≥ (1/√8)(1 - 1/√(4π ln M)) to limit adversarial advantage, preventing strong privacy and high utility simultaneously.
-
Beyond Membership: Limitations of Add/Remove Adjacency in Differential Privacy
Add/remove adjacency in DP overstates attribute privacy relative to substitute adjacency; new auditing attacks confirm inconsistency with add/remove reports but consistency with substitute accounting.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.