# Assessing differentially private deep learning with Membership Inference

arXiv: https://arxiv.org/abs/1912.11328 · HTML: https://mlsanity.com/paper/1912.11328/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Dec 2019.

## Built on by (most cited first, 11 of 11)

- [Large Scale Private Learning via Low-rank Reparametrization](https://mlsanity.com/paper/2106.09352/) (2021)
- [Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning](https://mlsanity.com/paper/2102.12677/) (2021)
- [Privacy-Preserving Machine Learning: Methods, Challenges and Directions](https://mlsanity.com/paper/2108.04417/) (2021)
- [Mixed Differential Privacy in Computer Vision](https://mlsanity.com/paper/2203.11481/) (2022)
- [Exploring the Limits of Differentially Private Deep Learning with Group-wise Clipping](https://mlsanity.com/paper/2212.01539/) (2022)
- [Individual Privacy Accounting for Differentially Private Stochastic Gradient Descent](https://mlsanity.com/paper/2206.02617/) (2022)
- [Semantic Membership Inference Attack against Large Language Models](https://mlsanity.com/paper/2406.10218/) (2024)
- [Responsible and Regulatory Conform Machine Learning for Medicine: A Survey of Challenges and Solutions](https://mlsanity.com/paper/2107.09546/) (2021)
- [On the privacy-utility trade-off in differentially private hierarchical text classification](https://mlsanity.com/paper/2103.02895/) (2021)
- [PrivatEyes: Appearance-based Gaze Estimation Using Federated Secure Multi-Party Computation](https://mlsanity.com/paper/2402.18970/) (2024)
- [Quantifying identifiability to choose and audit ε in differentially private deep learning](https://mlsanity.com/paper/2103.02913/) (2021)

## Abstract (arXiv)

Attacks that aim to identify the training data of public neural networks represent a severe threat to the privacy of individuals participating in the training data set. A possible protection is offered by anonymization of the training data or training function with differential privacy. However, data scientists can choose between local and central differential privacy and need to select meaningful privacy parameters ε which is challenging for non-privacy experts. We empirically compare local and central differential privacy mechanisms under white- and black-box membership inference to evaluate their relative privacy-accuracy trade-offs. We experiment with several datasets and show that this trade-off is similar for both types of mechanisms. This suggests that local differential privacy is a sound alternative to central differential privacy for differentially private deep learning, since small ε in central differential privacy and large ε in local differential privacy result in similar membership inference attack risk.