Unified Mechanism-Specific Amplification by Subsampling and Group Privacy Amplification

Overview

• Amplification by subsampling is a key technique in machine learning with differential privacy
• Subsampling, or training on random batches instead of full datasets, can improve privacy
• This paper proposes a new framework for deriving tighter, mechanism-specific privacy guarantees for subsampled mechanisms

Plain English Explanation

Differential privacy is a way to protect people's privacy when using their data to train machine learning models. One important technique in differential privacy is subsampling - instead of training on a full dataset, the model is trained on random subsets or "batches" of the data. This can help improve privacy, but the exact privacy guarantees are complex to calculate.

This paper introduces a new framework that can derive more precise privacy guarantees for subsampled mechanisms. Rather than relying on general rules, the framework leverages additional details about the specific mechanism being used to get tighter bounds on the privacy loss. This is especially important for privacy accounting, which is the process of tracking privacy over multiple rounds of training.

The paper shows how this framework can be used to analyze the privacy of subsampling for different types of differential privacy, like approximate DP and Rényi DP. It also looks at how subsampling affects the privacy of groups of users, going beyond classic "group privacy" results.

Overall, this new framework provides a more principled and powerful way to understand the privacy benefits of subsampling in machine learning with differential privacy.

Technical Explanation

The paper proposes a general framework for deriving mechanism-specific subsampling guarantees, which leverage additional details about the subsampled mechanism beyond just the original privacy parameters. This allows for tighter characterization of the subsampled mechanism's privacy compared to prior mechanism-agnostic approaches.

The framework is based on conditional optimal transport, which provides a way to relate the privacy of the subsampled mechanism to the privacy of the original mechanism. This lets the authors derive both existing and novel subsampling guarantees for different differential privacy variants, like approximate DP and Rényi DP, in a unified manner.

As a key application, the paper analyzes how subsampling affects the privacy of groups of users. The mechanism-specific bounds derived with this framework outperform both tight mechanism-agnostic bounds as well as classic group privacy results.

Critical Analysis

The paper makes a technical contribution by providing a principled framework for deriving mechanism-specific subsampling guarantees. This is an important advance, as prior work relied on more general, mechanism-agnostic rules that could not capture the full nuances of different DP mechanisms.

That said, the framework is quite complex and may be challenging for practitioners to apply directly. The authors acknowledge this and suggest the framework is more suited for privacy analysis by experts than for direct use in system design.

Additionally, the paper focuses on the analysis of subsampling, but does not address other important aspects of privacy accounting, such as the effects of other common techniques like gradient clipping or differential private stochastic gradient descent (DP-SGD). Further research is needed to fully understand the privacy properties of end-to-end DP machine learning systems.

Conclusion

This paper introduces a powerful new framework for deriving tight, mechanism-specific privacy guarantees for subsampled differential privacy mechanisms. By leveraging conditional optimal transport, the framework can capture more details about the specific mechanism being used, leading to improved privacy accounting compared to prior mechanism-agnostic approaches.

While the technical details may be complex, this work represents an important advance in the rigorous analysis of privacy amplification techniques. As machine learning systems continue to be deployed in sensitive domains, tools like this framework will be crucial for ensuring robust privacy protections for individuals' data.