Sensitivity Analysis

The maximum Euclidean distance between the outputs of a function computed on any two adjacent datasets differing by one record. This metric directly calibrates the scale of Gaussian noise added in the Gaussian Mechanism. For a query function f, it is defined as the supremum of ||f(D) − f(D')||₂ over all adjacent D, D'. A smaller global sensitivity allows for less noise and higher utility.

A data-dependent measure of the maximum change in a function's output when a specific record is added or removed from a fixed, concrete dataset. Unlike global sensitivity, it does not consider the worst-case over all possible datasets. While it is often much smaller, adding noise proportional to local sensitivity can leak information about the dataset itself, requiring smoothing techniques like the smooth sensitivity framework to provide rigorous privacy guarantees.

A framework that computes a smoothed upper bound on the local sensitivity of a function to avoid leaking information through the noise scale itself. It is defined by considering the maximum local sensitivity across datasets within a certain distance. This allows for adding significantly less noise than global sensitivity for functions with high variability, such as the median, while still satisfying pure differential privacy.

The core operation in DP-SGD that bounds the influence of any single training example on the model update. The gradient for each sample is computed, and its L2 norm is clipped to a maximum threshold C. This directly enforces a bounded sensitivity for the gradient computation step, transforming an unbounded influence into a controlled one before Gaussian noise is added. The clipping threshold is a critical hyperparameter balancing privacy and learning speed.

The general principle of measuring the maximum magnitude of change in a query's output caused by a unit change in the input. For a counting query, the sensitivity is 1. For a sum query, it is bounded by the data range. This concept is the bridge between a specific data analysis task and the amount of noise required by a privacy mechanism like the Laplace Mechanism, which calibrates to L1 sensitivity, or the Gaussian Mechanism, which calibrates to L2 sensitivity.

A privacy amplification phenomenon where the act of randomly sampling a mini-batch from the dataset before computing a private update provides a stronger overall privacy guarantee. The sensitivity of the operation remains bounded by the clipping threshold, but the probability of a specific record being included is reduced. This allows the total privacy loss (epsilon) to compose more slowly, making deep learning with differential privacy practically feasible.

The maximum possible change in a query function's output when a single record is added to or removed from any possible dataset. Formally, for a function f, global sensitivity is the supremum of ||f(D) - f(D')|| over all adjacent datasets D and D'.

• L1 sensitivity: Maximum absolute difference summed across output dimensions
• L2 sensitivity: Maximum Euclidean distance between output vectors
• Used to calibrate the Laplace Mechanism and Gaussian Mechanism
• Independent of the actual dataset—depends only on the query function
• Example: A counting query has global sensitivity of 1; a sum query bounded by [0, B] has sensitivity B

The maximum change in a query function's output when a single record is modified, measured with respect to a specific, fixed dataset rather than all possible datasets. Local sensitivity can be significantly smaller than global sensitivity.

• Captures how sensitive a query is on the actual data at hand
• Cannot be used directly for differential privacy without smooth sensitivity smoothing
• Direct use leaks information about the dataset structure
• Example: The median of {1, 2, 3, 100, 101} has high local sensitivity near the gap; the median of {1, 2, 3, 4, 5} has low local sensitivity

A framework introduced by Nissim, Raskhodnikova, and Smith that computes a smoothed upper bound on local sensitivity to enable data-dependent noise calibration while preserving differential privacy.

• Defined as the maximum local sensitivity at distance k, scaled by an exponentially decaying factor
• Enables adding less noise than global sensitivity requires for queries with low local sensitivity
• Computationally intensive for complex functions
• Critical for privately releasing medians, modes, and other robust statistics
• Provides instance-optimal noise calibration without privacy leakage

A preprocessing step in DP-SGD that bounds the L2 norm of each individual training example's gradient to a fixed threshold C. This directly enforces a sensitivity bound on the gradient computation.

• Clipping threshold C becomes the sensitivity parameter for the Gaussian mechanism
• Gradients with norm > C are scaled down to norm C; those ≤ C are unchanged
• Smaller C = tighter sensitivity = less noise required, but more information discarded
• Trades off utility vs. privacy: aggressive clipping biases the gradient direction
• The clipping operation itself is not differentially private—privacy comes from the subsequent noise addition

The statistical distinguishability between a model's outputs on training versus non-training data, which functions as an empirical sensitivity measure exploited by membership inference attacks.

• Models with high sensitivity to training examples exhibit large confidence gaps
• Overfitting amplifies effective sensitivity, making attacks easier
• Loss-based attacks measure sensitivity through prediction error differentials
• Gap attacks exploit the sensitivity of the confidence margin between top-1 and top-2 predictions
• Reducing effective sensitivity through regularization and differential privacy is the primary defense

A probabilistic characterization of the divergence between output distributions of a mechanism run on two adjacent datasets. The privacy loss random variable captures the full spectrum of possible privacy leakage.

• Defined as the log-ratio of probability densities: ln(P(M(D)=o) / P(M(D')=o))
• The privacy loss distribution governs tight composition bounds
• Sensitivity directly shapes this distribution—higher sensitivity widens the loss distribution
• Used in Moments Accountant and Rényi DP accounting
• Tail bounds on the privacy loss distribution yield (ε, δ)-differential privacy guarantees