Gaussian Noise Mechanism

The Gaussian mechanism achieves (ε, δ)-differential privacy by adding random noise drawn from a zero-mean Gaussian (normal) distribution to the true output of a query. The scale of the noise is proportional to the L2-sensitivity of the function and inversely proportional to the privacy budget ε. The δ parameter accounts for a small, non-zero probability that the privacy guarantee fails, distinguishing it from pure ε-differential privacy.

The magnitude of noise is directly governed by the query's L2-sensitivity (Δ₂f), which measures the maximum change in the output's Euclidean distance when a single record is added or removed from the dataset. A higher sensitivity requires more noise to mask the contribution of any individual. For a function f, the sensitivity is defined as:

• Δ₂f = max ||f(D) - f(D')||₂ over all adjacent datasets D and D'

In Differentially Private Stochastic Gradient Descent (DP-SGD), the Gaussian mechanism is applied to clipped gradients during training. The process involves:

• Gradient Clipping: Bounding the L2 norm of each per-example gradient to a threshold C to enforce a finite sensitivity.
• Noise Addition: Adding isotropic Gaussian noise scaled to C and the privacy parameters.
• Privacy Accounting: Tracking the cumulative privacy loss over multiple iterations using a moments accountant to compute the total (ε, δ) guarantee.

While the Laplace mechanism provides pure ε-differential privacy, the Gaussian mechanism offers approximate (ε, δ)-differential privacy. The key trade-offs are:

• Composition: Gaussian noise composes more gracefully under multiple queries, making it preferred for iterative algorithms like DP-SGD.
• Sensitivity Metric: Laplace uses L1-sensitivity; Gaussian uses L2-sensitivity. For high-dimensional vectors, the L2 norm is typically smaller, often requiring less noise to achieve a comparable privacy guarantee.

The privacy loss random variable for the Gaussian mechanism follows a distribution defined by the ratio of the noise-added output probabilities on adjacent datasets. The δ parameter explicitly bounds the tail probability of this privacy loss distribution, allowing for a small chance that the loss exceeds the nominal ε bound. This relaxation is what enables the mechanism's tight composition properties and its applicability to high-dimensional machine learning models.

In federated learning for telecom data, the Gaussian mechanism is applied locally at each base station before transmitting model updates to the central aggregator. This ensures that the aggregator—or any party intercepting the communication—cannot infer the presence of a specific user's data in the local training set. Combined with secure aggregation, this provides a dual layer of cryptographic and statistical privacy protection.

The mathematical framework that the Gaussian mechanism implements. It provides a formal guarantee that the output of a computation is statistically indistinguishable whether or not any single individual's data is included. The guarantee is parameterized by the privacy budget (ε, delta). The Gaussian mechanism specifically satisfies (ε, δ)-differential privacy, where δ allows for a small probability of the privacy guarantee being broken, a necessary relaxation for the Gaussian distribution's infinite support.

A quantifiable metric, denoted by epsilon (ε), that controls the total information leakage allowed. The Gaussian mechanism's noise scale is calibrated directly against ε and δ. A smaller epsilon (e.g., ε = 0.1) enforces a strong guarantee but requires injecting more noise, reducing model utility. Tracking the cumulative epsilon spend across multiple queries or training rounds is critical to avoid privacy budget exhaustion.

A preprocessing step essential for the Gaussian mechanism in deep learning. Before noise is added, the L2 norm of each per-sample gradient is bounded to a fixed threshold (C). This defines the sensitivity of the computation. Without clipping, a single outlier training example could have an arbitrarily large gradient, requiring infinite noise to mask it. Clipping bounds the worst-case influence of any individual.

A property that provides a tighter privacy guarantee when using the Gaussian mechanism with stochastic gradient descent. By randomly sampling a mini-batch from the dataset at each step, the chance that any specific record is included is reduced. This uncertainty amplifies the privacy guarantee, allowing for a lower effective epsilon than processing the full dataset. The subsampled Gaussian mechanism is the de facto standard for DP-SGD.

The primary threat the Gaussian mechanism defends against. In this attack, an adversary analyzes a model's predictions to determine if a specific record was in the training set. The calibrated noise from the Gaussian mechanism masks the subtle memorization signals that enable this inference. The privacy parameter epsilon directly quantifies the mechanism's resilience: a lower epsilon corresponds to a higher bound on the attacker's true positive rate vs. false positive rate trade-off.

A relaxation of standard differential privacy based on the Rényi divergence, offering tighter composition bounds than the basic (ε, δ) accounting. The Gaussian mechanism naturally fits this framework. When composing many Gaussian mechanisms across training steps, RDP provides a more accurate estimate of the total privacy loss, converting back to an (ε, δ) guarantee at the end. This is the accounting method used in modern libraries like Opacus and TensorFlow Privacy.