Differentially Private Stochastic Gradient Descent (DP-SGD)

Unlike standard SGD which computes gradients over a mini-batch, DP-SGD computes the gradient for each individual training example independently. Each per-sample gradient is then clipped to a maximum L2 norm bound C. This bounding operation limits the influence any single data point can exert on the model update, preventing outliers or memorized secrets from dominating the gradient signal. The clipping threshold is a critical hyperparameter: too low destroys utility, too high weakens privacy.

After clipping and aggregating the per-sample gradients, DP-SGD adds isotropic Gaussian noise calibrated to the clipping norm and a privacy loss parameter. The noise scale is proportional to C / σ, where σ is the noise multiplier. This step ensures the output distribution of the training step is statistically indistinguishable whether or not any single record participated. The mechanism satisfies the mathematical definition of (ε, δ)-differential privacy through the Gaussian mechanism's sensitivity-bounded noise addition.

DP-SGD leverages Poisson subsampling or uniform shuffling to randomly select mini-batches at each iteration. The randomness of whether a given record participates in a training step amplifies the privacy guarantee beyond what the Gaussian mechanism alone provides. This privacy amplification theorem means that even with moderate noise per step, the overall privacy loss ε grows sublinearly with the number of training epochs, enabling practical deep learning with meaningful privacy budgets.

Tracking cumulative privacy loss across thousands of training steps requires a tight composition theorem. DP-SGD employs the moments accountant, which bounds the privacy loss random variable's moment-generating function rather than using simple linear composition. This technique provides significantly tighter (ε, δ) bounds compared to advanced composition theorems, reducing the total privacy cost by a factor of 2-5x for typical deep learning workloads. The accountant computes the optimal trade-off between ε and δ at any training step.

Computing per-sample gradients breaks the vectorized efficiency of standard deep learning frameworks. DP-SGD implementations must unroll the mini-batch into individual forward-backward passes or use efficient ghost clipping techniques that compute per-sample norms without materializing full per-sample gradients. This introduces a computational overhead of 2-10x compared to non-private training, depending on batch size and model architecture. Modern frameworks like Opacus use virtual step batching to amortize this cost.

The core tuning challenge in DP-SGD balances three parameters:

• Noise multiplier σ: Higher values add more noise, strengthening privacy but degrading accuracy
• Clipping norm C: Controls the sensitivity bound; must be tuned per model architecture
• Lot size / sampling rate q: The probability of a record appearing in a batch

Typical configurations for CIFAR-10 achieve ε ≈ 2-8 with accuracy within 5-10% of non-private baselines. Large pre-trained models fine-tuned with DP-SGD can achieve ε ≈ 8 with minimal accuracy degradation.

The reconstruction of private training data from publicly shared model gradients. In federated learning, raw gradient updates can be inverted to reveal pixel-accurate images or verbatim text from a client's local batch. DP-SGD directly mitigates this by clipping per-sample gradients and adding Gaussian noise before aggregation, breaking the deterministic link between the input and the shared update.

A quantifiable limit on total privacy loss permitted across a series of differentially private computations. The epsilon (ε) parameter controls the noise multiplier in DP-SGD:

• ε < 1: Strong privacy, significant utility degradation
• 1 < ε < 10: Practical balance for most production models
• ε > 10: Weak guarantees, approaching non-private training Each DP-SGD step consumes a portion of the budget, tracked via Rényi Differential Privacy accountants.

An attack that reconstructs representative features of a class from model outputs. In facial recognition, this can produce a recognizable composite of individuals in the training set. DP-SGD limits inversion success by bounding the influence of any single training sample on the learned decision boundaries, preventing the model from memorizing and later leaking distinctive individual features.

A distributed training paradigm where local data never leaves the device. Clients compute model updates locally and share only gradients with a central server. Adding DP-SGD at the client level—via DP-FedAvg or DP-FedSGD—ensures the server cannot reconstruct any individual's data from the aggregated update. Secure aggregation protocols further encrypt individual gradients before summation.

The fundamental balancing act between privacy strength and model accuracy. DP-SGD's noise multiplier and clipping threshold directly control this trade-off:

• Tighter clipping reduces sensitivity but discards information
• Higher noise strengthens privacy but degrades gradient signal
• More training epochs improve utility but consume more privacy budget Optimal hyperparameter tuning requires careful epsilon-accuracy Pareto frontier analysis.