DP-SGD

The first step in bounding sensitivity. Instead of computing the average gradient over a batch, DP-SGD computes the gradient for each individual data point. Each per-sample gradient vector is then clipped to a maximum L2 norm (the clipping threshold C). This ensures no single training example can exert an arbitrarily large influence on the model update, limiting the privacy loss per step.

After clipping and summing the per-sample gradients, calibrated random noise drawn from a Gaussian distribution is added to the aggregate. The scale of this noise is proportional to the clipping threshold C and inversely proportional to the target privacy parameter epsilon (ε). This noise masks the contribution of any single individual, providing the formal guarantee of differential privacy.

A crucial component that tracks the cumulative privacy budget consumed over many training steps. The accountant uses advanced composition theorems (like Rényi Differential Privacy) to calculate the total (ε, δ)-differential privacy guarantee. It signals when training must stop to prevent exceeding a pre-defined privacy limit, managing the trade-off between model utility and privacy.

The core tension in DP-SGD. Stronger privacy (lower ε) requires more noise, which degrades model accuracy. Key levers for tuning this trade-off include:

• Noise Multiplier: Higher values increase privacy but hurt utility.
• Clipping Threshold: A smaller C limits sensitivity but can bias gradients.
• Training Steps: More steps improve utility but consume the privacy budget faster.
• Batch Size: Larger batches reduce noise variance for a given privacy level.

The primary threat vector that DP-SGD is designed to neutralize. In standard distributed learning, raw gradients shared by a client contain exploitable information about the local training batch. Attackers use gradient inversion to reconstruct high-fidelity private inputs. DP-SGD's per-sample clipping and Gaussian noise injection mathematically bound the information content of the released gradient, rendering inversion attacks ineffective.

A cryptographic protocol often paired with DP-SGD in federated learning. While DP-SGD protects against an honest-but-curious server analyzing individual updates, Secure Aggregation ensures the server can only compute the sum of encrypted model updates without inspecting any single client's contribution. This provides a defense-in-depth approach:

• DP-SGD: Protects the final aggregated model from memorizing individual data.
• Secure Aggregation: Protects individual updates in transit from the server itself.

The critical pre-processing step in the DP-SGD algorithm. Before adding noise, the algorithm computes the L2 norm of each per-sample gradient and scales it down if it exceeds a predefined clipping threshold (C). This bounds the sensitivity of the query—the maximum influence any single data point can have on the gradient. Without clipping, a single outlier could require infinite noise to mask, destroying model utility.

The mechanism for tracking cumulative privacy expenditure during DP-SGD training. The Moments Accountant is the standard technique that provides a tight bound on the total privacy loss (ε) across many iterations. It computes the Rényi Differential Privacy of the subsampled Gaussian mechanism, allowing practitioners to stop training precisely when the allocated privacy budget is exhausted, ensuring a strict contractual guarantee.

A robustness guarantee addressing a different threat model than DP-SGD. While DP-SGD assumes an honest-but-curious server protecting against data leakage, Byzantine Fault Tolerance defends against malicious clients sending arbitrary, crafted updates to corrupt the global model. Aggregation rules like Krum or Trimmed Mean are often combined with DP-SGD to simultaneously provide privacy and robustness against active adversaries.