Individual Privacy Accounting with Gaussian Differential PrivacyDownload PDF

Published: 21 Nov 2022, Last Modified: 21 Apr 2024TSRML2022Readers: Everyone
Keywords: differential privacy, gaussian differential privacy, fully adaptive compositions, privacy accounting, individual privacy accounting
TL;DR: Accurate privacy analysis of fully adaptive compositions using Gaussian differential privacy
Abstract: Individual privacy accounting enables bounding differential privacy (DP) loss individually for each participant involved in the analysis. This can be informative as often the individual privacy losses are considerably smaller than those indicated by the DP bounds that are based on considering worst-case bounds at each data access. In order to account for the individual privacy losses in a principled manner, we need a privacy accountant for adaptive compositions of randomised mechanisms, where the loss incurred at a given data access is allowed to be smaller than the worst-case loss. This kind of analysis has been carried out for the R\'enyi differential privacy (RDP) by Feldman and Zrnic (2021), however not yet for the so-called optimal privacy accountants. We make first steps in this direction by providing a careful analysis using the Gaussian differential privacy which gives optimal bounds for the Gaussian mechanism, one of the most versatile DP mechanisms. This approach is based on determining a certain supermartingale for the hockey-stick divergence and on extending the R\'enyi divergence-based fully adaptive composition results by Feldman and Zrnic (2021). We also consider measuring the individual $(\varepsilon,\delta)$-privacy losses using the so-called privacy loss distributions. With the help of the Blackwell theorem, we can then make use of the RDP analysis to construct an approximative individual $(\varepsilon,\delta)$-accountant. As an observation of indepedent interest, we experimentally illustrate that individual filtering leads to a disparate loss of accuracies among subgroups when training a neural network using DP gradient descent.
Community Implementations: [![CatalyzeX](/images/catalyzex_icon.svg) 1 code implementation](
3 Replies