mlsanityData to 7 Oct 2026

Gaussian DP for Reporting Differential Privacy Guarantees in Machine Learning

arXiv 2503.10945 ↗First posted 13 Mar 2025cs.LG cs.AI cs.CRcited by 6

Not on the map. Why?

Abstract (arXiv)

Current practices for reporting differential privacy (DP) guarantees for machine learning (ML) algorithms such as DP-SGD provide an incomplete and potentially misleading picture. For instance, if only a single (varepsilon, δ) is known about a mechanism, standard analyses show that there could exist highly accurate inference attacks against training data records, when, upon a more careful analysis, such accurate attacks do not exist for most practical mechanisms. In this position paper, we argue that using non-asymptotic_ Gaussian Differential Privacy (GDP) as the primary means of communicating DP guarantees in ML avoids these potential downsides. Using two recent developments in the DP literature: (i) open-source numerical accountants capable of computing the privacy profile and f-DP curves of DP-SGD to arbitrary accuracy, and (ii) a decision-theoretic metric over DP representations, we show how to provide non-asymptotic bounds on GDP using numerical accountants, and show that GDP can capture the entire privacy profile of DP-SGD and related algorithms with virtually no error, as quantified by the metric. To support our claims, we investigate the privacy profiles of state-of-the-art DP large-scale image classification, and the TopDown algorithm for the U.S. Decennial Census, observing that GDP fits their profiles remarkably well in all cases. We conclude with a discussion on the strengths and weaknesses of this approach, and discuss which other privacy mechanisms could benefit from GDP.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 37 of its 60 references that are in the map. First posted on arXiv 13 Mar 2025.

Builds on

37 of 60 references.

References · 37

  1. 2016Deep Learning with Differential Privacycited by 2,682
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2021Membership Inference Attacks From First Principlescited by 839
  4. 2017Renyi Differential Privacycited by 643
  5. 2021Differentially Private Fine-tuning of Language Modelscited by 392
  6. 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
  7. 2016Concentrated Differential Privacy: Simplifications, Extensions, and Lower Boundscited by 339
  8. 2013The Composition Theorem for Differential Privacycited by 290
  9. 2018Scalable Private Learning with PATEcited by 266
  10. 2018Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergencescited by 237
  11. 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 199
  12. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
25 more
  1. 2021Numerical Composition of Differential Privacycited by 174
  2. 2021Practical and Private (Deep) Learning without Sampling or Shufflingcited by 169
  3. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 150
  4. 2016Concentrated Differential Privacycited by 139
  5. 2020The Discrete Gaussian for Differential Privacycited by 134
  6. 2019Deep Learning with Gaussian Differential Privacycited by 112
  7. 2014Differentially Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Boundscited by 104
  8. 2019Hypothesis Testing Interpretations and Renyi Differential Privacycited by 84
  9. 2021Optimal Accounting of Differential Privacy via Characteristic Functioncited by 83
  10. 2023Differentially Private Synthetic Data via Foundation Model APIs 1: Imagescited by 63
  11. 2022Connect the Dots: Tighter Discrete Approximations of Privacy Loss Distributionscited by 50
  12. 2022Private Convex Optimization via Exponential Mechanismcited by 47
  13. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  14. 2020Tight Differential Privacy for Discrete-Valued Mechanisms and for the Subsampled Gaussian Mechanism Using FFTcited by 43
  15. 2022Geographic Spines in the 2020 Census Disclosure Avoidance Systemcited by 42
  16. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  17. 2020Three Variants of Differential Privacy: Lossless Conversion and Applicationscited by 25
  18. 2024Mind the Privacy Unit! User-Level Differential Privacy for Language Model Fine-Tuningcited by 21
  19. 2021Computing Differential Privacy Guarantees for Heterogeneous Compositions Using FFTcited by 20
  20. 2022Individual Privacy Accounting with Gaussian Differential Privacycited by 19
  21. 2020Differentially Private Bayesian Inference for Generalized Linear Modelscited by 16
  22. 2023Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacycited by 14
  23. 2024Beyond the Calibration Point: Mechanism Comparison in Differential Privacycited by 8
  24. 2024Attack-Aware Noise Calibration for Differential Privacycited by 6
  25. 2024Noise-Aware Differentially Private Regression via Meta-Learningcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 5.

6 papers.

  1. 2025Model Agnostic Differentially Private Causal Inferencecited by 2
  2. 2026Trade-off Functions for DP-SGD with Subsampling based on Random Allocation: Tight Upper and Lower Boundscited by 1
  3. 2026Near-Optimal Private Tests for Simple and MLR Hypothesescited by 0
  4. 2026Tight Auditing of Differential Privacy in MST and AIMcited by 0
  5. 2026Advancing the State-of-the-Art in Empirical Privacy Auditingcited by 0
  6. 2026A Sieve-Accelerated Quadrature Method for Exact Privacy Accounting in the 2020 U.S. Decennial Censuscited by 0