# On Choosing the μ Parameter in Gaussian Differential Privacy

arXiv: https://arxiv.org/abs/2606.09582 · HTML: https://mlsanity.com/paper/2606.09582/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 10 references that are in the map.
- First posted on arXiv 8 Jun 2026.

## Builds on (most cited first, 5 of 5)

- [The Composition Theorem for Differential Privacy](https://mlsanity.com/paper/1311.0776/) (2013)
- [Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences](https://mlsanity.com/paper/1807.01647/) (2018)
- [Differential Privacy as a Mutual Information Constraint](https://mlsanity.com/paper/1608.03677/) (2016)
- [SoK: Differential Privacies](https://mlsanity.com/paper/1906.01337/) (2019)
- [Attack-Aware Noise Calibration for Differential Privacy](https://mlsanity.com/paper/2407.02191/) (2024)

## Abstract (arXiv)

Recent work argues for using Gaussian differential privacy (GDP) to report the privacy guarantees in privacy-preserving machine learning. We provide principled mappings from pure-DP varepsilon to GDP μ by matching the worst-case success of a strong-adversary membership inference attack in terms of three metrics: multiplicative advantage at fixed FPR, precision at fixed recall, and the standard privacy profile. We tabulate μ values across a useful range of parameters and recommend μ ≈ varepsilon/5 as a conservative general-purpose conversion.