mlsanityData to 14 Oct 2026

Differentially Private Learning Needs Hidden State (Or Much Faster Convergence)

arXiv 2203.05363 ↗First posted 10 Mar 2022stat.ML cs.CR cs.LGcited by 48

Not on the map. Why?

Abstract (arXiv)

Prior work on differential privacy analysis of randomized SGD algorithms relies on composition theorems, where the implicit (unrealistic) assumption is that the internal state of the iterative algorithm is revealed to the adversary. As a result, the R'enyi DP bounds derived by such composition-based analyses linearly grow with the number of training epochs. When the internal state of the algorithm is hidden, we prove a converging privacy bound for noisy stochastic gradient descent (on strongly convex smooth loss functions). We show how to take advantage of privacy amplification by sub-sampling and randomized post-processing, and prove the dynamics of privacy bound for "shuffle and partition" and "sample without replacement" stochastic mini-batch gradient descent schemes. We prove that, in these settings, our privacy bound converges exponentially fast and is substantially smaller than the composition bounds, notably after a few number of training epochs. Thus, unless the DP algorithm converges fast, our privacy analysis shows that hidden state analysis can significantly amplify differential privacy.

Key facts. Cited by 48 papers in the map (data through 14 Oct 2026). Builds on 26 of its 44 references that are in the map. First posted on arXiv 10 Mar 2022.

Builds on

26 of 44 references.

References · 26

  1. 2016Deep Learning with Differential Privacycited by 2,728
  2. 2020Extracting Training Data from Large Language Modelscited by 2,189
  3. 2018Group Normalizationcited by 1,524
  4. 2017Renyi Differential Privacycited by 650
  5. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 383
  6. 2019Why gradient clipping accelerates training: A theoretical justification for adaptivitycited by 341
  7. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
  8. 2018Subsampled R'enyi Differential Privacy and Analytical Moments Accountantcited by 236
  9. 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 235
  10. 2019Rapid Convergence of the Unadjusted Langevin Algorithm: Isoperimetry Sufficescited by 227
  11. 2019Differentially Private Learning with Adaptive Clippingcited by 220
  12. 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 204
14 more
  1. 2019Private Stochastic Convex Optimization with Optimal Ratescited by 186
  2. 2021Practical and Private (Deep) Learning without Sampling or Shufflingcited by 170
  3. 2020Private Stochastic Convex Optimization: Optimal Rates in Linear Timecited by 153
  4. 2020Understanding Gradient Clipping in Private SGD: A Geometric Perspectivecited by 142
  5. 2014Differentially Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Boundscited by 107
  6. 2018Privacy Amplification by Iterationcited by 100
  7. 2020Hiding Among the Clones: A Simple and Nearly Optimal Analysis of Privacy Amplification by Shufflingcited by 96
  8. 2019AdaCliP: Adaptive Clipping for Private SGDcited by 77
  9. 2021Differential Privacy Dynamics of Langevin Diffusion and Noisy Gradient Descentcited by 73
  10. 2021Stochastic Training is Not Necessary for Generalizationcited by 63
  11. 2021Private Adaptive Gradient Methods for Convex Optimizationcited by 46
  12. 2021On the Convergence and Calibration of Deep Learning with Differential Privacycited by 36
  13. 2019Privacy Amplification by Mixing and Diffusion Mechanismscited by 21
  14. 2022Differential Privacy Guarantees for Stochastic Gradient Langevin Dynamicscited by 19

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 3; 2023: 7; 2024: 18; 2025: 13; 2026: 7.

48 papers.

Sort:

By area:

  1. 2022Privacy of Noisy Stochastic Gradient Descent: More Iterations without More Privacy Losscited by 61
  2. 2022TAN Without a Burn: Scaling Laws of DP-SGDcited by 52
  3. 2024Langevin Unlearning: A New Perspective of Noisy Gradient Descent for Machine Unlearningcited by 49
  4. 2023Bounding Training Data Reconstruction in DP-SGDcited by 46
  5. 2023Faster high-accuracy log-concave sampling via algorithmic warm startscited by 45
  6. 2024Auditing f-Differential Privacy in One Runcited by 30
  7. 2022Resolving the Mixing Time of the Langevin Algorithm to its Stationary Distribution for Log-Concave Samplingcited by 22
  8. 2023Have it your way: Individualized Privacy Assignment for DP-SGDcited by 21
  9. 2024Nearly Tight Black-Box Auditing of Differentially Private Machine Learningcited by 21
  10. 2024Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Modelcited by 18
  11. 2023Differentially Private SGD Without Clipping Bias: An Error-Feedback Approachcited by 14
  12. 2024Certified Machine Unlearning via Noisy Stochastic Gradient Descentcited by 14
36 more
  1. 2023Unified Enhancement of Privacy Bounds for Mixture Mechanisms via f-Differential Privacycited by 13
  2. 2024Shifted Interpolation for Differential Privacycited by 13
  3. 2024The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGDcited by 11
  4. 2023Privacy Loss of Noisy Stochastic Gradient Descent Might Converge Even for Non-Convex Lossescited by 10
  5. 2024Neural Collapse Meets Differential Privacy: Curious Behaviors of NoisyGD with Near-perfect Representation Learningcited by 8
  6. 2024Convergent Privacy Loss of Noisy-SGD without Convexity and Smoothnesscited by 8
  7. 2024Privacy of the last iterate in cyclically-sampled DP-SGD on nonconvex composite lossescited by 6
  8. 2024To Shuffle or not to Shuffle: Auditing DP-SGD with Shufflingcited by 6
  9. 2025The Hitchhiker's Guide to Efficient, End-to-End, and Tight DP Auditingcited by 5
  10. 2025An Improved Privacy and Utility Analysis of Differentially Private SGD with Bounded Domain and Smooth Lossescited by 4
  11. 2024Privacy of SGD under Gaussian or Heavy-Tailed Noise: Guarantees without Gradient Clippingcited by 3
  12. 2025Empirical Privacy Variancecited by 3
  13. 2025Mitigating Privacy-Utility Trade-off in Decentralized Federated Learning via f-Differential Privacycited by 3
  14. 2024Convex Approximation of Two-Layer ReLU Networks for Hidden State Differential Privacycited by 2
  15. 2024Privacy-Preserving Split Learning with Vision Transformers using Patch-Wise Random and Noisy CutMixcited by 2
  16. 2025Hyperparameters in Score-Based Membership Inference Attackscited by 2
  17. 2023Privacy Amplification by Iteration for ADMM with (Strongly) Convex Objective Functionscited by 1
  18. 2024Certified Robustness to Clean-Label Poisoning Using Diffusion Denoisingcited by 1
  19. 2026Challenges in Enabling Private Data Valuationcited by 1
  20. 2024Differentially Private Neural Network Training Under the Hidden State Assumptioncited by 0
  21. 2024Convergent Differential Privacy Analysis for General Federated Learningcited by 0
  22. 2024Adversarial Sample-Based Approach for Tighter Privacy Auditing in Final Model-Only Scenarioscited by 0
  23. 2025Mixing Times and Privacy Analysis for the Projected Langevin Algorithm under a Modulus of Continuitycited by 0
  24. 2025Differential privacy guarantees of Markov chain Monte Carlo algorithmscited by 0
  25. 2025Controlled privacy leakage propagation throughout overlapping grouped learningcited by 0
  26. 2025Securing Transfer-Learned Networks with Reverse Homomorphic Encryptioncited by 0
  27. 2025Privacy Amplification in Differentially Private Zeroth-Order Optimization with Hidden Statescited by 0
  28. 2025Towards Reliable and Generalizable Differentially Private Machine Learning (Extended Version)cited by 0
  29. 2025High-Dimensional Privacy-Utility Dynamics of Noisy Stochastic Gradient Descent on Least Squarescited by 0
  30. 2025R'enyi Differential Privacy for Heavy-Tailed SDEs via Fractional Poincar'e Inequalitiescited by 0
  31. 2026SoK: Enhancing Cryptographic Collaborative Learning with Differential Privacycited by 0
  32. 2026Unlearning with Asymmetric Sources: Improved Unlearning-Utility Trade-off with Public Datacited by 0
  33. 2026Unveiling the Non-Monotonic Effect of Privacy on Generalization under Byzantine Robustnesscited by 0
  34. 2026Differential Privacy of Gradient Descent on Perturbed Objectivescited by 0
  35. 2026Can R'enyi Accountants Beat Lossless Accountants for DP-SGD?cited by 0
  36. 2026Counterfactual Certification for Sequential Unlearning with Long-Run Performance Guaranteescited by 0