mlsanityData to 7 Oct 2026

Individual Privacy Accounting for Differentially Private Stochastic Gradient Descent

arXiv 2206.02617 ↗First posted 6 Jun 2022cs.LG cs.CR cs.DScited by 20

Not on the map. Why?

Abstract (arXiv)

Differentially private stochastic gradient descent (DP-SGD) is the workhorse algorithm for recent advances in private deep learning. It provides a single privacy guarantee to all datapoints in the dataset. We propose output-specific (varepsilon,δ)-DP to characterize privacy guarantees for individual examples when releasing models trained by DP-SGD. We also design an efficient algorithm to investigate individual privacy across a number of datasets. We find that most examples enjoy stronger privacy guarantees than the worst-case bound. We further discover that the training loss and the privacy parameter of an example are well-correlated. This implies groups that are underserved in terms of model utility simultaneously experience weaker privacy guarantees. For example, on CIFAR-10, the average varepsilon of the class with the lowest test accuracy is 44.2% higher than that of the class with the highest accuracy.

Key facts. Cited by 20 papers in the map (data through 7 Oct 2026). Builds on 48 of its 77 references that are in the map. First posted on arXiv 6 Jun 2022.

Builds on

48 of 77 references.

References · 48

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Deep Learning with Differential Privacycited by 2,682
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  4. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  5. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  6. 2021Membership Inference Attacks From First Principlescited by 839
  7. 2017Renyi Differential Privacycited by 643
  8. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 492
  9. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 447
  10. 2017Age Progression/Regression by Conditional Adversarial Autoencodercited by 426
  11. 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
  12. 2021Differentially Private Fine-tuning of Language Modelscited by 392
36 more
  1. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 375
  2. 2020Label-Only Membership Inference Attackscited by 371
  3. 2018Fairness Without Demographics in Repeated Loss Minimizationcited by 363
  4. 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
  5. 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
  6. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  7. 2018Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergencescited by 237
  8. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  9. 2018Subsampled R'enyi Differential Privacy and Analytical Moments Accountantcited by 234
  10. 2019Differentially Private Learning with Adaptive Clippingcited by 218
  11. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
  12. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
  13. 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 199
  14. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  15. 2021Numerical Composition of Differential Privacycited by 174
  16. 2020Understanding Gradient Clipping in Private SGD: A Geometric Perspectivecited by 140
  17. 2020Tempered Sigmoid Activations for Deep Learning with Differential Privacycited by 121
  18. 2021Large-Scale Differentially Private BERTcited by 117
  19. 2019Deep Learning with Gaussian Differential Privacycited by 112
  20. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  21. 2020Characterizing Structural Regularities of Labeled Data in Overparameterized Modelscited by 93
  22. 2021Large Scale Private Learning via Low-rank Reparametrizationcited by 87
  23. 2020Individual Privacy Accounting via a Renyi Filtercited by 57
  24. 2022Mixed Differential Privacy in Computer Visioncited by 53
  25. 2022Scalable and Efficient Training of Large Convolutional Neural Networks with Differential Privacycited by 47
  26. 2022Large Scale Transfer Learning for Differentially Private Image Classificationcited by 40
  27. 2020Chasing Your Long Tails: Differentially Private Prediction in Health Care Settingscited by 37
  28. 2019Disparate Vulnerability to Membership Inference Attackscited by 33
  29. 2017Towards Measuring Membership Privacycited by 27
  30. 2022Fully Adaptive Composition in Differential Privacycited by 22
  31. 2017Accuracy First: Selecting a Differential Privacy Level for Accuracy-Constrained ERMcited by 20
  32. 2021Practical Privacy Filters and Odometers with R'enyi Differential Privacy and Applications to Differentially Private Deep Learningcited by 12
  33. 2021Privately Publishable Per-instance Privacycited by 12
  34. 2019Assessing differentially private deep learning with Membership Inferencecited by 11
  35. 2022The Impact of Differential Privacy on Group Disparity Mitigationcited by 11
  36. 2022Exploring the Unfairness of DP-SGD Across Settingscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 6; 2025: 4; 2026: 5.

20 papers.

Sort:

By area:

  1. 2024PrE-Text: Training Language Models on Private Federated Data in the Age of LLMscited by 29
  2. 2023Have it your way: Individualized Privacy Assignment for DP-SGDcited by 21
  3. 2023Gradients Look Alike: Sensitivity is Often Overestimated in DP-SGDcited by 11
  4. 2024Noise-Aware Algorithm for Heterogeneous Differentially Private Federated Learningcited by 9
  5. 2024Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learningcited by 6
  6. 2024Certification for Differentially Private Prediction in Gradient-Based Trainingcited by 6
  7. 2024Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methodscited by 6
  8. 2025Crowding Out The Noise: Algorithmic Collective Action Under Differential Privacycited by 4
  9. 2025Leveraging Per-Instance Privacy for Machine Unlearningcited by 4
  10. 2023Personalized DP-SGD using Sampling Mechanismscited by 2
  11. 2023SoK: Memorisation in machine learningcited by 1
  12. 2025Laplace Sample Information: Data Informativeness Through a Bayesian Lenscited by 1
8 more
  1. 2026Your Privacy Depends on Others: Collusion Vulnerabilities in Individual Differential Privacycited by 1
  2. 2023Personalized Privacy Amplification via Importance Samplingcited by 0
  3. 2024A Survey on Differential Privacy for SpatioTemporal Data in Transportation Researchcited by 0
  4. 2025Controlled privacy leakage propagation throughout overlapping grouped learningcited by 0
  5. 2026PrivacyBench: Privacy Isn't Free in Hybrid Privacy-Preserving Vision Systemscited by 0
  6. 2026Technical Case Study of Privacy-Enhancing Technologies (PETs) for Public Healthcited by 0
  7. 2026PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantizationcited by 0
  8. 2026Performative Privacy: When Differential Privacy Maximizes Utilitycited by 0