# Input Perturbation: A New Paradigm between Central and Local Differential Privacy

arXiv: https://arxiv.org/abs/2002.08570 · HTML: https://mlsanity.com/paper/2002.08570/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Feb 2020.

## Built on by (most cited first, 6 of 6)

- [A Comparative Analysis of Word-Level Metric Differential Privacy: Benchmarking The Privacy-Utility Trade-off](https://mlsanity.com/paper/2404.03324/) (2024)
- [Differentially Private Federated Learning via Inexact ADMM](https://mlsanity.com/paper/2106.06127/) (2021)
- [DP-UTIL: Comprehensive Utility Analysis of Differential Privacy in Machine Learning](https://mlsanity.com/paper/2112.12998/) (2021)
- [Differentially Private Federated Learning via Inexact ADMM with Multiple Local Updates](https://mlsanity.com/paper/2202.09409/) (2022)
- [Production of Categorical Data Verifying Differential Privacy: Conception and Applications to Machine Learning](https://mlsanity.com/paper/2204.00850/) (2022)
- [Does Privacy Always Harm Fairness? Data-Dependent Trade-offs via Chernoff Information Neural Estimation](https://mlsanity.com/paper/2601.13698/) (2026)

## Abstract (arXiv)

Traditionally, there are two models on differential privacy: the central model and the local model. The central model focuses on the machine learning model and the local model focuses on the training data. In this paper, we study the textitinput perturbation method in differentially private empirical risk minimization (DP-ERM), preserving privacy of the central model. By adding noise to the original training data and training with the `perturbed data', we achieve (ε,δ)-differential privacy on the final model, along with some kind of privacy on the original data. We observe that there is an interesting connection between the local model and the central model: the perturbation on the original data causes the perturbation on the gradient, and finally the model parameters. This observation means that our method builds a bridge between local and central model, protecting the data, the gradient and the model simultaneously, which is more superior than previous central methods. Detailed theoretical analysis and experiments show that our method achieves almost the same (or even better) performance as some of the best previous central methods with more protections on privacy, which is an attractive result. Moreover, we extend our method to a more general case: the loss function satisfies the Polyak-Lojasiewicz condition, which is more general than strong convexity, the constraint on the loss function in most previous work.