Differentially Private Generative Adversarial Network (DP-GAN)

The core innovation of DP-GANs is applying DP-SGD exclusively to the discriminator during training. Per-example gradients are clipped to a fixed L2 norm threshold and Gaussian noise is injected before the update. This ensures the discriminator's learned decision boundary does not memorize individual training samples. Crucially, the generator only accesses data indirectly through the discriminator's noisy gradients, benefiting from the post-processing immunity property of differential privacy.

DP-GANs rely on the Moments Accountant to track cumulative privacy loss across thousands of training iterations. Unlike basic composition theorems that yield loose linear bounds, the moments accountant computes the Rényi divergence of the privacy loss random variable at each step. This provides significantly tighter estimates of the total ε and δ, allowing more training epochs within a given privacy budget before the guarantee degrades.

Once trained, the generator can sample an unlimited number of synthetic records without consuming additional privacy budget. The generated data preserves the statistical structure of the original sensitive dataset—including correlations and marginal distributions—while providing a formal (ε, δ)-differential privacy guarantee. This enables downstream tasks like model prototyping, A/B testing, and third-party data sharing without exposing real individual records.

Before noise is added, each per-example gradient is scaled down if its L2 norm exceeds a predefined clipping threshold C. This bounds the sensitivity of the training step—the maximum influence any single record can have on the model update. The noise scale σ is then calibrated to C and the target ε. Selecting C is critical: too low destroys useful signal, too high requires excessive noise. Adaptive clipping heuristics are often employed.

DP-GANs embody the fundamental tension between privacy and utility. Tighter privacy (lower ε) requires more noise, which degrades the fidelity of generated samples. Practitioners navigate this trade-off through:

• Architectural choices: Simpler discriminators require less noise
• Hyperparameter tuning: Clipping threshold C and noise multiplier σ
• Data volume: Larger datasets dilute individual influence, improving the privacy-utility frontier
• Early stopping: Halting training before the privacy budget is exhausted

Many DP-GAN implementations adopt the WGAN-GP architecture, which uses the Wasserstein distance as the loss function and a gradient penalty for Lipschitz continuity. This stabilizes training under noisy gradient updates, mitigating mode collapse. The gradient penalty is computed on interpolated samples between real and generated data, and its gradients are also subject to clipping and noise injection to maintain the privacy guarantee throughout the entire training procedure.

A critical preprocessing step that bounds the L2 norm of per-example gradients to a fixed threshold C before noise injection.

• Limits the sensitivity of the discriminator's update
• Prevents any single training example from dominating the gradient
• Clipping threshold is a crucial hyperparameter balancing privacy and utility
• Too low: destroys useful signal; too high: requires excessive noise

In DP-GAN, clipping is applied exclusively to the discriminator's gradients during training, as only the discriminator accesses real data.

The noise injection method used in DP-GAN training, adding calibrated Gaussian noise to clipped gradients to achieve (ε, δ)-differential privacy.

• Noise scale σ is calibrated to the clipping threshold and privacy budget
• Satisfies approximate DP with a small failure probability δ
• More efficient than the Laplace mechanism for high-dimensional gradient vectors
• Enables tight composition accounting across thousands of training iterations

The Gaussian mechanism is the standard choice for DP-SGD and its GAN variant due to its compatibility with L2 sensitivity.

A privacy accounting technique that tracks higher-order moments of the privacy loss random variable to provide tighter bounds on cumulative ε.

• Significantly more accurate than basic composition theorems
• Reduces the total privacy budget consumption by avoiding overestimation
• Essential for deep learning where thousands of iterations compound privacy loss
• Enables training with practical ε values (e.g., ε < 10)

Without the moments accountant, DP-GAN training would require prohibitive amounts of noise, rendering generated samples useless.

A fundamental property of differential privacy guaranteeing that any computation applied to a DP output cannot weaken the privacy guarantee.

• Once the discriminator is trained with DP, the generator inherits the same privacy bound
• Generated synthetic samples can be shared, analyzed, or published freely
• No additional privacy leakage occurs from downstream use of the synthetic data
• This property is what makes DP-GAN outputs safe for unlimited distribution

Post-processing immunity ensures that the generator's outputs carry the same (ε, δ) guarantee as the discriminator's training process.

The phenomenon where randomly sampling a mini-batch from the dataset before applying DP-SGD results in a stronger privacy guarantee than processing the full dataset.

• Each data point has only a probability q of participating in any given iteration
• Amplification factor is proportional to q² for (ε, δ)-DP
• Enables training with smaller per-iteration noise while maintaining overall privacy
• A core reason why DP-GAN can achieve reasonable utility

The combination of subsampling amplification and the moments accountant is what makes differentially private deep learning practical.

In DP-GAN, differential privacy is applied exclusively to the discriminator, as it is the only component that directly accesses real training data.

• The generator never sees real data; it only receives gradients from the discriminator
• Noise is added to the discriminator's gradients during backpropagation
• The generator learns solely from the DP-sanitized signal
• This architectural separation is key to the DP-GAN design pattern

By the post-processing immunity property, the generator's outputs automatically satisfy the same privacy guarantee as the discriminator's training.