Gaussian Differential Privacy

Abstract

Differential privacy has seen remarkable success as a rigorous and practical formalization of data privacy in the past decade. This privacy definition and its divergence based relaxations, however, have several acknowledged weaknesses, either in handling composition of private algorithms or in analyzing important primitives like privacy amplification by subsampling. Inspired by the hypothesis testing formulation of privacy, this paper proposes a new relaxation, which we term `$f$-differential privacy' ($f$-DP). This notion of privacy has a number of appealing properties and, in particular, avoids difficulties associated with divergence based relaxations. First, $f$-DP preserves the hypothesis testing interpretation. In addition, $f$-DP allows for lossless reasoning about composition in an algebraic fashion. Moreover, we provide a powerful technique to import existing results proven for original DP to $f$-DP and, as an application, obtain a simple subsampling theorem for $f$-DP. In addition to the above findings, we introduce a canonical single-parameter family of privacy notions within the $f$-DP class that is referred to as `Gaussian differential privacy' (GDP), defined based on testing two shifted Gaussians. GDP is focal among the $f$-DP class because of a central limit theorem we prove. More precisely, the privacy guarantees of \emph{any} hypothesis testing based definition of privacy (including original DP) converges to GDP in the limit under composition. The CLT also yields a computationally inexpensive tool for analyzing the exact composition of private algorithms. Taken together, this collection of attractive properties render $f$-DP a mathematically coherent, analytically tractable, and versatile framework for private data analysis. Finally, we demonstrate the use of the tools we develop by giving an improved privacy analysis of noisy stochastic gradient descent.

v2 revises introduction, adds discussion and fixes some inconsistencies. v3 fixes typos

References in corpus (6)

• Deep Learning with Differential Privacy
• Renyi Differential Privacy
• Bag of Freebies for Training Object Detection Neural Networks
• Bag of Tricks for Image Classification with Convolutional Neural Networks
• Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoising
• The Cost of Privacy: Rates of Convergence for Parameter Estimation with Differential Privacy

Cited by in corpus (41)

• Privacy in Deep Learning: A Survey
• PPGAN: Privacy-preserving Generative Adversarial Network
• Auditing Differentially Private Machine Learning: How Private is Private SGD?
• Large Language Models Can Be Strong Differentially Private Learners
• Privately Fine-Tuning Large Language Models with Differential Privacy
• The Cost of Privacy: Rates of Convergence for Parameter Estimation with Differential Privacy
• Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning
• Hypothesis Testing Interpretations and Renyi Differential Privacy
• Privacy-Preserving Dynamic Personalized Pricing with Demand Learning
• Deep Learning with Gaussian Differential Privacy
• Individual Privacy Accounting via a Renyi Filter
• A Primer on Private Statistics
• A Differentially Private Framework for Deep Learning with Convexified Loss Functions
• A Theoretical Perspective on Differentially Private Federated Multi-task Learning
• Measuring Data Leakage in Machine-Learning Models with Fisher Information
• Enhanced Membership Inference Attacks against Machine Learning Models
• The Cost of Privacy in Generalized Linear Models: Algorithms and Minimax Lower Bounds
• Efficient Privacy-Preserving Stochastic Nonconvex Optimization
• Differentially Private False Discovery Rate Control
• Element Level Differential Privacy: The Right Granularity of Privacy
• On the Convergence and Calibration of Deep Learning with Differential Privacy
• Optimal Differential Privacy Composition for Exponential Mechanisms and the Cost of Adaptivity
• Dynamic Differential-Privacy Preserving SGD
• Complex-valued Federated Learning with Differential Privacy and MRI Applications
• GAL: Gradient Assisted Learning for Decentralized Multi-Organization Collaborations
• Accuracy, Interpretability, and Differential Privacy via Explainable Boosting
• Context-Aware Local Differential Privacy
• Differentially Private Bayesian Neural Networks on Accuracy, Privacy and Reliability
• Bounding, Concentrating, and Truncating: Unifying Privacy Loss Composition for Data Analytics
• On the Privacy Risks of Deploying Recurrent Neural Networks in Machine Learning Models
• Sharp Composition Bounds for Gaussian Differential Privacy via Edgeworth Expansion
• Quantifying the Privacy Risks of Learning High-Dimensional Graphical Models
• High-Dimensional Differentially-Private EM Algorithm: Methods and Near-Optimal Statistical Guarantees
• Privacy-Aware Rejection Sampling
• FedPower: Privacy-Preserving Distributed Eigenspace Estimation
• NeuralDP Differentially private neural networks by design
• Concurrent Composition of Differential Privacy
• Privacy Amplification via Iteration for Shuffled and Online PNSGD
• Privacy accounting $\epsilon$conomics: Improving differential privacy composition via a posteriori bounds
• Differentially Private n-gram Extraction
• Smoothed Differential Privacy