On Choosing the $\hat{I}¼$ Parameter in Gaussian Differential Privacy

Abstract

Recent work argues for using Gaussian differential privacy (GDP) to report the privacy guarantees in privacy-preserving machine learning. We provide principled mappings from pure-DP $\epsilon$ to GDP $\hat{I}¼$ by matching the worst-case success of a strong-adversary membership inference attack in terms of three metrics: multiplicative advantage at fixed FPR, precision at fixed recall, and the standard privacy profile. We tabulate $\hat{I}¼$ values across a useful range of parameters and recommend $\hat{I}¼\approx \epsilon /5$ as a conservative general-purpose conversion.