Differentially Private Stochastic Gradient Descent (DP-SGD)

A critical pre-processing step in DP-SGD that bounds the influence of any single training example on the model update.

• Mechanism: The L2 norm of each per-sample gradient is computed. If it exceeds a predefined threshold C, the gradient is scaled down to have a norm exactly equal to C.
• Purpose: This bounds the sensitivity of the gradient computation, which is a necessary condition for applying the Gaussian noise mechanism to achieve differential privacy.
• Trade-off: A smaller clipping threshold provides stronger privacy but may discard useful information, slowing convergence.

A quantifiable metric that controls the total allowable privacy loss in a differentially private system.

• Definition: A lower epsilon (e.g., ε = 0.1) provides a stronger mathematical guarantee that an adversary cannot distinguish between two datasets differing by one record.
• Composition: Privacy loss accumulates with each query or training step. DP-SGD uses a moments accountant to track the total spent budget over training epochs.
• Practical Impact: Setting the budget involves a direct privacy-utility trade-off; exhausting the budget requires stopping training to prevent further leakage.

The core randomization technique that provides the differential privacy guarantee in DP-SGD.

• Process: After per-sample gradients are clipped, calibrated random noise drawn from a Gaussian distribution is added to the aggregated gradient before the model weights are updated.
• Calibration: The noise scale is proportional to the clipping norm C and inversely proportional to the target privacy parameter ε. More noise yields stronger privacy but degrades model utility.
• Goal: This ensures the final model parameters are statistically indistinguishable from parameters trained on a dataset without a specific individual's record.

A sophisticated algorithm for tracking the cumulative privacy loss over multiple iterations of DP-SGD.

• Function: It provides a tight bound on the total privacy cost by computing the log moments of the privacy loss random variable, rather than relying on loose standard composition theorems.
• Advantage: This method allows for a significantly lower overall epsilon value for the same number of training steps compared to basic composition, enabling more training under a fixed budget.
• Integration: It is the standard privacy accounting method implemented in libraries like TensorFlow Privacy and Opacus.

A fundamental architectural requirement of DP-SGD that distinguishes it from standard mini-batch SGD.

• Standard SGD: Averages gradients across a batch, losing individual sample contributions immediately.
• DP-SGD: Requires computing and storing the gradient for each individual example in a batch separately. This is necessary to perform per-sample clipping before aggregation.
• Engineering Cost: This process is memory-intensive and computationally slower, as it prevents the use of highly optimized vectorized batch operations without specialized frameworks.

The fundamental balancing act between the strength of the privacy guarantee and the resulting accuracy of the trained model.

• The Tension: Injecting noise to achieve a low epsilon (strong privacy) inevitably degrades the fidelity of the gradient signal, potentially leading to lower model accuracy or slower convergence.
• Tuning: Practitioners must tune the clipping norm and noise multiplier to find an acceptable operating point where the model remains useful for its intended task while providing a meaningful privacy guarantee.
• No Free Lunch: A perfectly private model (ε = 0) is useless, and a perfectly accurate model offers no differential privacy.