Subsampled Rényi Differential Privacy and Analytical Moments Accountant

By Yu-Xiang Wang, Borja Balle, Shiva Prasad Kasiviswanathan. 2018

494 citations recorded by the source corpus.

We study the problem of subsampling in differential privacy (DP), a question that is the centerpiece behind many successful differentially private machine learning algorithms. Specifically, we provide a tight upper bound on the Renyi Differential Privacy (RDP) [Mironov, 2017] parameters for algorithms that: (1) subsample the dataset, and then (2) apply a randomized mechanism M to the subsample, in terms of the RDP parameters of M and the subsampling probability parameter.Our results generalize the moments accounting technique, developed by [Abadi et al. 2016] for the Gaussian mechanism, to any subsampled RDP mechanism.

Subfields: Artificial Intelligence, Computational Theory and Mathematics, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computational Theory and Mathematics

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, methodology): “To track the overall privacy budget across rounds, advanced composition theorems [148, 221] or the analytical moments accountant method developed in [7, 297, 299, 405] can be used.”
Practical and Private (Deep) Learning without Sampling or Shuffling (2021, methodology): “from D at each time step2 t, then privacy amplification by sampling (Kasiviswanathan et al., 2008; Bassily et al., 2014; Abadi et al., 2016; Wang et al., 2019) allows one to scale down the noise to σt · (k/n), while still ensuring εt-differential privacy.”
The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation (2021, methodology): “That is, we can use standard privacy accounting techniques (Bun & Steinke, 2016; Mironov, 2017; Wang et al., 2019) to analyse the more complex system, as long as we have differential privacy guarantees for the basic protocol that is used as a subroutine.”
Differentially Private Learning Needs Better Features (or Much More Data) (2020, methodology): “When applying Data Normalization to ScatterNet features, we compute the per-channel statistics only over the original CIFAR-10 samples, and compute the privacy guarantees of PrivDataNorm using the Rényi DP analysis of the sampled Gaussian mechanism (Mironov et al., 2019; Wang et al., 2019).”
Privacy Amplification via Random Check-Ins (2020, background): “It achieves optimal error for convex problems [9], and can also be applied to non-convex problems, including deep learning, where the privacy amplification offered by randomly subsampling data to form batches is critical for obtaining meaningful DP guarantees under computational constraints [25, 9, ”
Generative Models for Effective ML on Private, Decentralized Datasets (2019, methodology): “To obtain precise DP guarantees, we use the analytical moments accountant of subsampled Rényi differential privacy (RDP) method developed in Wang et al. (2018).”
Differentially Private Learning with Adaptive Clipping (2019, neutral): “On no conﬁguration was the optimal server learning rate as high as 10 times the baseline, indicating that this grid is large enough.”
Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences (2018, methodology): “Rényi DP ampliﬁcation bounds for subsampling without replacement were developed in [Wang et al., 2018].”
Bounding Training Data Reconstruction in Private (Deep) Learning (2022, background): “, 2016) and RDP (Wang et al., 2019; Mironov et al., 2019); the proof is given in Appendix B.”
Automatic Discovery of Privacy–Utility Pareto Fronts (2019, methodology): “[48] for Rényi DP amplification by subsampling without replacement.”
Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, methodology): “We employ the AutoDP framework1 to calibrate the differentially private Gaussian noise to the privacy budget using Renyi DP [165].”
Private-kNN: Practical Differential Privacy for Computer Vision (2020, methodology): “All privacy guarantee that we report in this paper is based on the analytical moments account [26] that keeps track of the entire RDP function in their analytical form and solve for ǫ given δ via a binary search.”
Poission Subsampled Rényi Differential Privacy (2019, methodology): “Complementing a recent result on this problem that deals with “Sampling without Replacement” (Wang et al., 2019), we address the “Poisson subsampling” scheme which selects each data point independently with probability γ.”
Differentially Private Federated Learning: An Information-Theoretic Perspective (2021, methodology): “The Eε-divergence representation of DP was used in (Balle & Wang, 2018; Balle et al., 2018; 2019b;c; Wang et al., 2018) to prove new privacy results or simplify the proofs of existing results.”