Rényi Differential Privacy of the Sampled Gaussian Mechanism

By Ilya Mironov, Kunal Talwar, Li Zhang. 2019

347 citations recorded by the source corpus.

The Sampled Gaussian Mechanism (SGM)---a composition of subsampling and the additive Gaussian noise---has been successfully used in a number of machine learning applications. The mechanism's unexpected power is derived from privacy amplification by sampling where the privacy cost of a single evaluation diminishes quadratically, rather than linearly, with the sampling rate. Characterizing the precise privacy properties of SGM motivated development of several relaxations of the notion of differential privacy. This work unifies and fills in gaps in published results on SGM. We describe a numerically stable procedure for precise computation of SGM's Renyi Differential Privacy and prove a nearly tight (within a small constant factor) closed-form bound.

Subfields: Artificial Intelligence, Computer Science Applications, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Science Applications

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, methodology): “To track the overall privacy budget across rounds, advanced composition theorems [148, 221] or the analytical moments accountant method developed in [7, 297, 299, 405] can be used.”
The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation (2021, methodology): “We adopt the tight amplification bound from Mironov et al. (2019) for Gaussian and the generic upper bound from Zhu & Wang (2019) for DDGauss (we do not explore a precise analysis in this work), which could lead to more noise being added for DDGauss to achieve the same privacy as Gaussian.”
Differentially Private Learning Needs Better Features (or Much More Data) (2020, methodology): “The PrivDataNorm procedure is (α, α/σ2norm)-RDP for any α > 1.”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, methodology): “This is much better than RDP, PLD, and exponential mechanism accounting.”
Large Language Models Can Be Strong Differentially Private Learners (2021, methodology): “We train all models under approximate-DP (Dwork et al., 2014), and we view two datasets as being adjacent if and only if one can be obtained from the other by including an extra record (Mironov et al., 2019).”
TAN without a burn: Scaling Laws of DP-SGD (2022, methodology): “The existence of a phase transition with a sub-sampled Gaussian mechanism is also noticed in Abadi et al. (2016); Mironov et al. (2019).”
Unlocking High-Accuracy Differentially Private Image Classification through Scale (2022, methodology): “In this work we use the accounting method for DP-SGD proposed by Mironov et al. (2019) and implemented in TensorFlow Privacy (Google, 2018).”
End-to-end privacy preserving deep learning on multi-institutional medical imaging (2021, methodology): “Per-node privacy budgeting is performed using the Rényi Differential Privacy Accountant 24 .”
Bounding Training Data Reconstruction in Private (Deep) Learning (2022, methodology): “The following theorem shows that private SGD with FIL accounting also enjoys a subsampling ampliﬁcation bound similar to DP (Abadi et al., 2016) and RDP (Wang et al., 2019; Mironov et al., 2019); the proof is given in Appendix B. Theorem 4.”
On the Importance of Difficulty Calibration in Membership Inference Attacks (2021, background): “Their analysis has further been refined (Mironov, 2017; Mironov et al., 2019) and has been shown experimentally to be tight (Nasr et al.”
Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning (2021, background): “[41] showed tighter bounds for a given σ.”