User-Level Privacy

Unlike event-level privacy, which protects a single action or record, user-level privacy protects all records contributed by a single individual within a dataset. This prevents an attacker from inferring a user's presence by observing patterns across multiple related data points. For example, in a messaging app, event-level privacy might hide a single message, while user-level privacy hides the entire conversation history of a target user.

The core mathematical distinction lies in the definition of neighboring datasets. In user-level DP, two datasets are neighbors if one can be obtained from the other by adding or removing all records belonging to a single user. This is a stricter condition than record-level DP, where neighbors differ by a single row. The larger sensitivity introduced by this definition requires proportionally more noise to achieve the same epsilon guarantee.

Because a single user can contribute an unbounded number of records, the L1 or L2 sensitivity of a query can be significantly larger under user-level privacy. If a user contributes up to k records, the sensitivity scales by a factor of k. This necessitates mechanisms like group privacy or restricted sensitivity to bound the contribution per user, often through clipping or capping the number of records per user before analysis.

Achieving user-level privacy typically involves a two-stage process:

• Contribution Limiting: Capping the maximum number of records k any single user can contribute to the dataset.
• Group Privacy Amplification: Applying a standard mechanism (e.g., Gaussian or Laplace) with the privacy budget scaled by k, or using advanced composition theorems. The DP-SGD algorithm can be adapted for user-level privacy by grouping per-example gradients by user before clipping and noising the aggregated user-level gradient.

User-level privacy is critical in scenarios where individual contributions are inherently multi-record:

• Federated Learning: Protecting a client's entire local dataset during training rounds.
• Mobile Analytics: Hiding a user's complete app interaction history from telemetry systems.
• Medical Studies: Obscuring a patient's full longitudinal health record across multiple visits.
• Recommendation Systems: Preventing inference of a user's entire rating or watch history.

The stronger guarantee of user-level privacy comes at a higher utility cost compared to record-level privacy for the same epsilon. Because the sensitivity is multiplied by the maximum user contribution k, the noise magnitude must increase proportionally. This makes user-level DP challenging for heavy users in long-tailed distributions. Techniques like user sampling and tight composition analysis (e.g., Moments Accountant) are essential to maintain practical model accuracy.

The weakest granularity of differential privacy, protecting only a single action or event contributed by a user. In this model, an adversary cannot determine if a specific click, purchase, or page view occurred, but can infer a user's presence through their aggregate contribution pattern. This is insufficient for protecting rich user profiles where a single individual contributes hundreds or thousands of records to a dataset.

In standard DP-SGD, gradients are clipped and noised on a per-example basis, treating each training sample independently. User-level privacy requires group-level clipping, where all gradients belonging to a single user are first aggregated, then the combined contribution is clipped to a fixed L2 norm threshold before noise is added. This prevents a user with many examples from dominating the update and leaking information through sheer volume.

A generalization of differential privacy that protects the presence or absence of an entire group of size k in the dataset. User-level privacy is a special case of group privacy where the group consists of all records belonging to one individual. The privacy guarantee degrades linearly with group size: achieving ε-user-level privacy for a user with k records requires ε/k event-level privacy, making it exponentially more expensive in terms of the privacy budget.

A critical technique for achieving practical user-level privacy. Instead of subsampling individual records, the algorithm randomly selects a subset of users in each training round and includes all of their records. This user-level Poisson sampling provides strong amplification of the privacy guarantee, as the uncertainty about whether any given user participated in a training step masks their entire contribution history.

A preprocessing step essential for user-level privacy that caps the maximum number of records any single user can contribute to the training dataset. Without contribution bounding, a user with an unbounded number of examples could force the sensitivity to be arbitrarily large, requiring infinite noise. Common strategies include:

• Truncation: randomly dropping excess records
• Aggregation: averaging or summing user records into a fixed-size representation
• Temporal decay: weighting recent records higher