Gaussian Mechanism

The formal privacy definition satisfied by the Gaussian Mechanism. Unlike pure ε-DP, this relaxation allows a small failure probability δ where the strict ε-guarantee may be violated. This relaxation is necessary for Gaussian noise, as the distribution's infinite support means a non-zero probability of catastrophic privacy loss. The δ parameter is typically chosen to be cryptographically small—much less than 1/N, where N is the dataset size—ensuring the mechanism is safe for practical use.

A modern privacy framework that characterizes mechanisms by their trade-off function between Type I and Type II errors in membership inference attacks. GDP provides a tight, operational interpretation of the Gaussian Mechanism's guarantee, showing that it is exactly equivalent to a hypothesis-testing problem. This framework enables precise composition and sub-sampling analysis, often yielding tighter bounds than traditional (ε, δ)-DP accounting.

A formal result quantifying how privacy loss accumulates when multiple differentially private mechanisms are applied to the same dataset. The Gaussian Mechanism benefits from advanced composition theorems, which show that the total privacy loss grows sub-linearly (proportional to the square root of the number of queries) rather than linearly. This makes the Gaussian Mechanism particularly efficient for iterative algorithms like DP-SGD, where thousands of noisy gradient steps are composed.

The foundational mechanism for achieving pure ε-differential privacy (δ = 0). It adds noise from a Laplace distribution calibrated to the L1 sensitivity of the query. While the Laplace Mechanism provides a stronger privacy guarantee than the Gaussian Mechanism, it composes poorly under repeated queries. For single-shot or low-query-count scenarios, the Laplace Mechanism is often preferred; for iterative workloads, the Gaussian Mechanism's tighter composition makes it the standard choice.

The dominant algorithm for training deep learning models with differential privacy, and the primary application of the Gaussian Mechanism. DP-SGD operates by:

• Clipping per-example gradients to bound sensitivity
• Adding Gaussian noise to the aggregated gradient
• Tracking privacy loss via a moments accountant The Gaussian Mechanism's tight composition properties make it the only viable noise distribution for the thousands of training iterations required by modern neural networks.

A privacy definition based on Rényi divergence that provides tighter composition bounds than standard (ε, δ)-DP. RDP is particularly well-suited to the Gaussian Mechanism, as the Rényi divergence between two Gaussian distributions has a simple closed-form expression. Many modern privacy accountants, including those in TensorFlow Privacy and Opacus, use RDP as an intermediate accounting method before converting back to (ε, δ)-DP for reporting.