Avoiding Pitfalls for Privacy Accounting of Subsampled Mechanisms under Composition

Fuente: arXiv
Saved in:
Bibliographic Details
Main Authors: Lebeda, Christian Janos, Regehr, Matthew, Kamath, Gautam, Steinke, Thomas
Format: Preprint
Published: 2024
Subjects:
Online Access:
Tags: Add Tag
No Tags, Be the first to tag this record!
_version_ 1866917980169830400
author Lebeda, Christian Janos
Regehr, Matthew
Kamath, Gautam
Steinke, Thomas
author_facet Lebeda, Christian Janos
Regehr, Matthew
Kamath, Gautam
Steinke, Thomas
contents We consider the problem of computing tight privacy guarantees for the composition of subsampled differentially private mechanisms. Recent algorithms can numerically compute the privacy parameters to arbitrary precision but must be carefully applied. Our main contribution is to address two common points of confusion. First, some privacy accountants assume that the privacy guarantees for the composition of a subsampled mechanism are determined by self-composing the worst-case datasets for the uncomposed mechanism. We show that this is not true in general. Second, Poisson subsampling is sometimes assumed to have similar privacy guarantees compared to sampling without replacement. We show that the privacy guarantees may in fact differ significantly between the two sampling schemes. In particular, we give an example of hyperparameters that result in $\varepsilon \approx 1$ for Poisson subsampling and $\varepsilon > 10$ for sampling without replacement. This occurs for some parameters that could realistically be chosen for DP-SGD.
format Preprint
id arxiv_https___arxiv_org_abs_2405_20769
institution arXiv
publishDate 2024
record_format arxiv
spellingShingle Avoiding Pitfalls for Privacy Accounting of Subsampled Mechanisms under Composition
Lebeda, Christian Janos
Regehr, Matthew
Kamath, Gautam
Steinke, Thomas
Cryptography and Security
Data Structures and Algorithms
Machine Learning
We consider the problem of computing tight privacy guarantees for the composition of subsampled differentially private mechanisms. Recent algorithms can numerically compute the privacy parameters to arbitrary precision but must be carefully applied. Our main contribution is to address two common points of confusion. First, some privacy accountants assume that the privacy guarantees for the composition of a subsampled mechanism are determined by self-composing the worst-case datasets for the uncomposed mechanism. We show that this is not true in general. Second, Poisson subsampling is sometimes assumed to have similar privacy guarantees compared to sampling without replacement. We show that the privacy guarantees may in fact differ significantly between the two sampling schemes. In particular, we give an example of hyperparameters that result in $\varepsilon \approx 1$ for Poisson subsampling and $\varepsilon > 10$ for sampling without replacement. This occurs for some parameters that could realistically be chosen for DP-SGD.
title Avoiding Pitfalls for Privacy Accounting of Subsampled Mechanisms under Composition
topic Cryptography and Security
Data Structures and Algorithms
Machine Learning
url https://arxiv.org/abs/2405.20769