mlsanityData to 14 Oct 2026

Composition of Differential Privacy & Privacy Amplification by Subsampling

arXiv 2210.00597 ↗First posted 2 Oct 2022cs.CR cs.DS cs.LGcited by 45

Not on the map. Why?

Abstract (arXiv)

This chapter is meant to be part of the book "Differential Privacy for Artificial Intelligence Applications." We give an introduction to the most important property of differential privacy -- composition: running multiple independent analyses on the data of a set of people will still be differentially private as long as each of the analyses is private on its own -- as well as the related topic of privacy amplification by subsampling. This chapter introduces the basic concepts and gives proofs of the key results needed to apply these tools in practice.

Key facts. Cited by 45 papers in the map (data through 14 Oct 2026). Builds on 34 of its 61 references that are in the map. First posted on arXiv 2 Oct 2022.

Builds on

34 of 61 references.

References · 34

  1. 2016Deep Learning with Differential Privacycited by 2,728
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  3. 2017Renyi Differential Privacycited by 650
  4. 2016Concentrated Differential Privacy: Simplifications, Extensions, and Lower Boundscited by 346
  5. 2013The Composition Theorem for Differential Privacycited by 297
  6. 2018Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergencescited by 242
  7. 2018Subsampled R'enyi Differential Privacy and Analytical Moments Accountantcited by 236
  8. 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 218
  9. 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 204
  10. 2021Numerical Composition of Differential Privacycited by 180
  11. 2018Amplification by Shuffling: From Local to Central Differential Privacy via Anonymitycited by 164
  12. 2016Concentrated Differential Privacycited by 144
22 more
  1. 2020The Discrete Gaussian for Differential Privacycited by 135
  2. 2018Distributed Differential Privacy via Shufflingcited by 115
  3. 2014Differentially Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Boundscited by 107
  4. 2020Hiding Among the Clones: A Simple and Nearly Optimal Analysis of Privacy Amplification by Shufflingcited by 96
  5. 2021Optimal Accounting of Differential Privacy via Characteristic Functioncited by 86
  6. 2018A General Approach to Adding Differential Privacy to Iterative Training Procedurescited by 84
  7. 2013Fingerprinting Codes and the Price of Approximate Differential Privacycited by 82
  8. 2019The Privacy Blanket of the Shuffle Modelcited by 74
  9. 2020Individual Privacy Accounting via a Renyi Filtercited by 59
  10. 2015Between Pure and Approximate Differential Privacycited by 56
  11. 2017Prochlo: Strong Privacy for Analytics in the Crowdcited by 51
  12. 2020Tight Differential Privacy for Discrete-Valued Mechanisms and for the Subsampled Gaussian Mechanism Using FFTcited by 43
  13. 2016Privacy Odometers and Filters: Pay-as-you-Go Compositioncited by 33
  14. 2020A Primer on Private Statisticscited by 30
  15. 2022Stronger Privacy Amplification by Shuffling for R'enyi and Approximate Differential Privacycited by 29
  16. 2020A Better Bound Gives a Hundred Rounds: Enhanced Privacy Guarantees via f-Divergencescited by 21
  17. 2021Computing Differential Privacy Guarantees for Heterogeneous Compositions Using FFTcited by 20
  18. 2022Faster Privacy Accounting via Evolving Discretizationcited by 15
  19. 2021Concurrent Composition of Differential Privacycited by 12
  20. 2022Composition Theorems for Interactive Differential Privacycited by 10
  21. 2022Concurrent Composition Theorems for Differential Privacycited by 8
  22. 2022The Saddle-Point Accountant for Differential Privacycited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 11; 2024: 19; 2025: 12; 2026: 3.

45 papers.

Sort:

By area:

  1. 2023Privacy Auditing with One (1) Training Runcited by 123
  2. 2023DP-Forward: Fine-tuning and Inference on Language Models with Differential Privacy in Forward Passcited by 67
  3. 2023(Amplified) Banded Matrix Factorization: A unified approach to private trainingcited by 49
  4. 2023One-shot Empirical Privacy Estimation for Federated Learningcited by 36
  5. 2024Privacy-Preserving Instructions for Aligning Large Language Modelscited by 35
  6. 2023Selective Pre-training for Private Fine-tuningcited by 23
  7. 2024Differentially Private Next-Token Prediction of Large Language Modelscited by 22
  8. 2023Practical Differentially Private Hyperparameter Tuning with Subsamplingcited by 19
  9. 2023Privacy Amplification for Matrix Mechanismscited by 17
  10. 2025Privacy amplification by random allocationcited by 15
  11. 2023On Differentially Private Federated Linear Contextual Banditscited by 14
  12. 2024Differential Privacy Mechanisms in Neural Tangent Kernel Regressioncited by 14
33 more
  1. 2024Avoiding Pitfalls for Privacy Accounting of Subsampled Mechanisms under Compositioncited by 13
  2. 2024The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGDcited by 11
  3. 2025Contrastive Private Data Synthesis via Weighted Multi-PLM Fusioncited by 11
  4. 2025InvisibleInk: High-Utility and Low-Cost Text Generation with Differential Privacycited by 10
  5. 2023Subsampling Suffices for Adaptive Data Analysiscited by 9
  6. 2024Truthfulness of Calibration Measurescited by 7
  7. 2024Revisiting Differentially Private Hyper-parameter Tuningcited by 5
  8. 2024Private Collaborative Edge Inference via Over-the-Air Computationcited by 5
  9. 2024Private Regression via Data-Dependent Sufficient Statistic Perturbationcited by 4
  10. 2024Adaptively Private Next-Token Prediction of Large Language Modelscited by 4
  11. 2025Large Language Model Powered Intelligent Urban Agents: Concepts, Capabilities, and Applicationscited by 4
  12. 2023IRG: Modular Synthetic Relational Database Generation with Complex Relational Schemascited by 3
  13. 2025Empirical Privacy Variancecited by 3
  14. 2026Efficient privacy loss accounting for subsampling and random allocationcited by 3
  15. 2024Differentially Private Synthetic Data Generation for Relational Databasescited by 2
  16. 2025Learning with Differentially Private (Sliced) Wasserstein Gradientscited by 2
  17. 2024Adaptive Data Analysis for Growing Datacited by 1
  18. 2024On Using Secure Aggregation in Differentially Private Federated Learning with Multiple Local Stepscited by 1
  19. 2024Federated Cubic Regularized Newton Learning with Sparsification-amplified Differential Privacycited by 1
  20. 2024Laplace Transform Interpretation of Differential Privacycited by 1
  21. 2025PREAMBLE: Private and Efficient Aggregation via Block Sparse Vectorscited by 1
  22. 2025DP-SPRT: Differentially Private Sequential Probability Ratio Testscited by 1
  23. 2023Personalized Privacy Amplification via Importance Samplingcited by 0
  24. 2024Weights Shuffling for Improving DPSGD in Transformer-based Modelscited by 0
  25. 2024Privacy-Preserving Dynamic Assortment Selectioncited by 0
  26. 2024Differentially Private Adaptation of Diffusion Models via Noisy Aggregated Embeddingscited by 0
  27. 2024Aggregating Data for Optimal and Private Learningcited by 0
  28. 2025It's My Data Too: Private ML for Datasets with Multi-User Training Examplescited by 0
  29. 2025Differentially Private Relational Learning with Entity-level Privacy Guaranteescited by 0
  30. 2025Federated Learning with Enhanced Privacy via Model Splitting and Random Client Participationcited by 0
  31. 2025Differential privacy from axiomscited by 0
  32. 2026On the Sample Complexity of Robust Binary Hypothesis Testingcited by 0
  33. 2026On Inherent Privacy of Posterior Sampling: A Unified R'enyi-Divergence Frameworkcited by 0