f-Differential Privacy (f-DP)

The core of f-DP is the trade-off function f(α), which maps any achievable false positive rate (Type I error) α to the smallest possible false negative rate (Type II error) 1-β. A mechanism M is f-DP if distinguishing between outputs on neighboring datasets is at least as difficult as distinguishing between the two hypotheses characterized by f. This operational definition directly connects the privacy parameter to the error rates of an adversary's membership inference attack.

f-DP can be equivalently characterized by the distribution of the privacy loss random variable. The trade-off function is the convex conjugate of the moment-generating function of the privacy loss. This dual perspective enables tight numerical composition using Fourier accounting and connects f-DP to other definitions:

• Gaussian Differential Privacy (GDP) is a special case where the trade-off function corresponds to distinguishing N(0,1) from N(μ,1)
• Rényi DP bounds the moment-generating function directly
• (ε, δ)-DP corresponds to a piecewise linear trade-off function

A key advantage of f-DP is that the composition of multiple mechanisms is exact and closed-form. The trade-off function for a sequence of adaptive mechanisms is the tensor product of their individual trade-off functions: f = f₁ ⊗ f₂ ⊗ ... ⊗ fₖ. This avoids the looseness introduced by composition theorems in (ε, δ)-DP and provides a tight, non-asymptotic characterization of cumulative privacy loss under adaptive composition.

Gaussian Differential Privacy (GDP) emerges as a central limit theorem for f-DP. Under repeated composition of many small privacy losses, the overall trade-off function converges to that of a Gaussian mechanism. This provides theoretical justification for using the Gaussian mechanism in iterative algorithms like DP-SGD, where the cumulative privacy loss is characterized by a single parameter μ, representing the signal-to-noise ratio of the underlying hypothesis test.

f-DP provides a clean characterization of privacy amplification by subsampling. When a mechanism is applied to a random subset of the data, the resulting trade-off function is a convex combination of the original trade-off function and perfect privacy (the identity function). This yields tighter bounds than those derived under (ε, δ)-DP, particularly for Poisson subsampling used in DP-SGD, enabling more accurate privacy accounting in deep learning.

f-DP enables the characterization of optimal mechanisms for specific trade-off functions. The framework reveals that the Gaussian mechanism is universally optimal for GDP, and more generally, the optimal noise-adding mechanism for a given trade-off function can be derived. This contrasts with (ε, δ)-DP, where the optimal mechanism is often intractable, and provides a principled approach to designing mechanisms that achieve the tightest possible privacy-utility trade-off.

The core mathematical object in f-DP that maps any false positive rate (Type I error) to the smallest achievable false negative rate (Type II error) in a membership inference attack. Unlike a single parameter, this function fully characterizes the privacy guarantee by describing the entire error profile an adversary faces when trying to distinguish neighboring datasets. A mechanism satisfies f-DP if its trade-off function dominates a boundary function f.

A single-parameter family within the f-DP framework where the trade-off function is derived from the hypothesis test between two Gaussian distributions. GDP is the exact privacy characterization of the Gaussian mechanism and emerges as a central limit theorem for privacy composition: as many small privacy-loss mechanisms are composed, the overall trade-off function converges to that of a GDP mechanism. Parameterized by μ, where smaller μ indicates stronger privacy.

The operational attack model that f-DP uses as its foundational adversary. An attacker with access to a model's output attempts to determine whether a specific record was in the training set. f-DP quantifies privacy by the optimal attacker's error trade-off:

• Type I error (α): Falsely concluding a non-member was in the training set
• Type II error (β): Falsely concluding a member was not in the training set The trade-off function f(α) gives the minimum achievable β at each α level.

f-DP can be equivalently expressed through the privacy profile δ(ε), which maps each ε value to the smallest δ such that the mechanism satisfies (ε, δ)-DP. This duality provides a bridge between f-DP and traditional definitions: the trade-off function f and the privacy profile δ(ε) are mathematically connected through convex conjugation. This allows practitioners to convert f-DP guarantees into familiar (ε, δ) parameters when needed for compliance reporting.

A key advantage of f-DP over (ε, δ)-DP: composition of trade-off functions is exact and tight through the tensor product operation. When mechanisms M₁ and M₂ with trade-off functions f₁ and f₂ are applied to the same dataset, the composed trade-off function is f₁ ⊗ f₂. This avoids the loose accounting that plagues advanced composition theorems in (ε, δ)-DP, enabling more accurate privacy budget tracking and allowing more queries under the same effective guarantee.

f-DP addresses several limitations of the traditional definition:

• Interpretability: Trade-off functions directly map to attacker error rates, while ε and δ are abstract parameters
• Tightness: f-DP composition is exact; (ε, δ)-DP composition uses loose bounds that overstate privacy loss
• Generality: Every (ε, δ)-DP mechanism can be characterized by an f-DP trade-off function, but f-DP captures mechanisms that (ε, δ)-DP cannot precisely describe
• No δ parameter: Eliminates the need to interpret the often-misunderstood failure probability δ