Gaussian Differential Privacy (GDP)

GDP characterizes privacy using a trade-off function f(P, Q) between two probability distributions. In the context of a membership inference attack, this function maps any chosen Type I error (false positive rate) to the smallest achievable Type II error (false negative rate). A mechanism M satisfies μ-GDP if distinguishing its output on neighboring datasets is at least as hard as distinguishing N(0,1) from N(μ,1). This provides a complete, operational description of privacy loss.

GDP is a specific, canonical instance of the broader f-Differential Privacy (f-DP) framework. While f-DP allows any convex, symmetric trade-off function, GDP restricts this to the trade-off function of two Gaussian distributions separated by mean μ. This specialization yields a single, interpretable parameter μ (the privacy parameter) that fully captures the privacy guarantee. A smaller μ indicates stronger privacy, with μ=0 corresponding to perfect privacy.

GDP provides a precise mapping to the classical (ε, δ)-DP definition. A μ-GDP mechanism satisfies (ε, δ)-DP for a continuum of (ε, δ) pairs lying on a specific curve. This relationship is given by: δ = Φ(-ε/μ + μ/2) - e^ε Φ(-ε/μ - μ/2), where Φ is the standard Gaussian CDF. This allows practitioners to translate GDP guarantees into the more widely recognized (ε, δ) language without loss of tightness.

A central limit theorem for privacy governs composition under GDP. When composing n independent μ_i-GDP mechanisms, the overall privacy guarantee converges to μ_total-GDP, where μ_total = sqrt(Σ μ_i^2). This is analogous to the Central Limit Theorem in statistics and is significantly tighter than advanced composition theorems for (ε, δ)-DP. This property makes GDP ideal for iterative algorithms like DP-SGD, where privacy loss accumulates over thousands of steps.

The Gaussian mechanism—adding isotropic Gaussian noise N(0, σ²I) to a query output—is a natural primitive for GDP. For a query with L2-sensitivity Δ, the mechanism satisfies μ-GDP with μ = Δ/σ. This clean relationship eliminates the need to separately track ε and δ, simplifying the design and analysis of differentially private systems. The mechanism's privacy guarantee is exact, not approximate.

GDP integrates seamlessly with privacy amplification by subsampling. When a μ-GDP mechanism is applied to a random subset of data sampled with probability q, the amplified guarantee is governed by a complex trade-off function. However, a tight approximation yields an effective μ' ≈ q * sqrt(e^(μ²) - 1). This amplification is critical for deep learning, where DP-SGD operates on mini-batches, dramatically reducing the per-iteration privacy cost.