# How Do Input Attributes Impact the Privacy Loss in Differential Privacy?

arXiv: https://arxiv.org/abs/2211.10173 · HTML: https://mlsanity.com/paper/2211.10173/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 19 references that are in the map.
- First posted on arXiv 18 Nov 2022.

## Builds on (most cited first, 10 of 10)

- [Inverting Gradients -- How easy is it to break privacy in federated learning?](https://mlsanity.com/paper/2003.14053/) (2020)
- [Renyi Differential Privacy](https://mlsanity.com/paper/1702.07476/) (2017)
- [A Survey on Neural Network Interpretability](https://mlsanity.com/paper/2012.14261/) (2020)
- [Reconstructing Training Data with Informed Adversaries](https://mlsanity.com/paper/2201.04845/) (2022)
- [Individual Privacy Accounting via a Renyi Filter](https://mlsanity.com/paper/2008.11193/) (2020)
- [A Haar Wavelet-Based Perceptual Similarity Index for Image Quality Assessment](https://mlsanity.com/paper/1607.06140/) (2016)
- [Bounding Training Data Reconstruction in Private (Deep) Learning](https://mlsanity.com/paper/2201.12383/) (2022)
- [Measuring Data Leakage in Machine-Learning Models with Fisher Information](https://mlsanity.com/paper/2102.11673/) (2021)
- [Layer-wise Characterization of Latent Information Leakage in Federated Learning](https://mlsanity.com/paper/2010.08762/) (2020)
- [Element Level Differential Privacy: The Right Granularity of Privacy](https://mlsanity.com/paper/1912.04042/) (2019)

## Built on by (most cited first, 2 of 2)

- [Incentivising the federation: gradient-based metrics for data selection and valuation in private decentralised training](https://mlsanity.com/paper/2305.02942/) (2023)
- [SoK: Memorisation in machine learning](https://mlsanity.com/paper/2311.03075/) (2023)

## Abstract (arXiv)

Differential privacy (DP) is typically formulated as a worst-case privacy guarantee over all individuals in a database. More recently, extensions to individual subjects or their attributes, have been introduced. Under the individual/per-instance DP interpretation, we study the connection between the per-subject gradient norm in DP neural networks and individual privacy loss and introduce a novel metric termed the Privacy Loss-Input Susceptibility (PLIS), which allows one to apportion the subject's privacy loss to their input attributes. We experimentally show how this enables the identification of sensitive attributes and of subjects at high risk of data reconstruction.