# A unified view on differential privacy and robustness to adversarial examples

arXiv: https://arxiv.org/abs/1906.07982 · HTML: https://mlsanity.com/paper/1906.07982/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Jun 2019.

## Built on by (most cited first, 9 of 9)

- [Noisy Feature Mixup](https://mlsanity.com/paper/2110.02180/) (2021)
- [Gradient Masking and the Underestimated Robustness Threats of Differential Privacy in Deep Learning](https://mlsanity.com/paper/2105.07985/) (2021)
- [Robust Estimation of Discrete Distributions under Local Differential Privacy](https://mlsanity.com/paper/2202.06825/) (2022)
- [Combining Differential Privacy and Byzantine Resilience in Distributed SGD](https://mlsanity.com/paper/2110.03991/) (2021)
- [Detecting Violations of Differential Privacy for Quantum Algorithms](https://mlsanity.com/paper/2309.04819/) (2023)
- [Bridging Privacy and Robustness for Trustworthy Machine Learning](https://mlsanity.com/paper/2403.16591/) (2024)
- [Understanding the Interplay between Privacy and Robustness in Federated Learning](https://mlsanity.com/paper/2106.07033/) (2021)
- [Fair Machine Learning in Healthcare: A Review](https://mlsanity.com/paper/2206.14397/) (2022)
- [Beyond Uniform Deletion: A Data Value-Weighted Framework for Certified Machine Unlearning](https://mlsanity.com/paper/2511.06794/) (2025)

## Abstract (arXiv)

This short note highlights some links between two lines of research within the emerging topic of trustworthy machine learning: differential privacy and robustness to adversarial examples. By abstracting the definitions of both notions, we show that they build upon the same theoretical ground and hence results obtained so far in one domain can be transferred to the other. More precisely, our analysis is based on two key elements: probabilistic mappings (also called randomized algorithms in the differential privacy community), and the Renyi divergence which subsumes a large family of divergences. We first generalize the definition of robustness against adversarial examples to encompass probabilistic mappings. Then we observe that Renyi-differential privacy (a generalization of differential privacy recently proposed in~citeMironov2017RenyiDP) and our definition of robustness share several similarities. We finally discuss how can both communities benefit from this connection to transfer technical tools from one research field to the other.