Privacy Accountant

The core function is to compute the total privacy cost when multiple differentially private mechanisms are applied sequentially. The accountant tracks how the privacy budget (ε) accumulates across training steps or queries. It applies composition theorems—such as basic composition, strong composition, or advanced composition—to bound the overall privacy loss. Without composition tracking, an adversary could combine outputs from multiple queries to amplify leakage beyond the intended guarantee.

A specific algorithmic approach introduced with DP-SGD that tracks the log of the moment-generating function of the privacy loss random variable. The moments accountant computes tighter bounds on cumulative privacy loss compared to standard strong composition theorems. It works by:

• Computing the privacy loss distribution at each step
• Tracking higher-order moments of this distribution
• Converting the accumulated moments back to an (ε, δ) guarantee This method is the default in frameworks like TensorFlow Privacy and Opacus.

An accountant based on Rényi divergence rather than the standard privacy loss random variable. RDP provides a natural framework for tracking privacy loss under Poisson subsampling and Gaussian noise mechanisms. Key properties:

• RDP parameters (α, ε) compose linearly: ε_total = Σ ε_i for a fixed α
• Converts cleanly to standard (ε, δ)-DP guarantees via a conversion lemma
• Yields significantly tighter bounds than the moments accountant for many practical regimes
• Implemented in libraries like tf-privacy and PyVacy

A hypothesis-testing-based framework that characterizes privacy loss using f-divergences and limit theorems. The GDP accountant leverages the fact that the privacy loss of many composed mechanisms converges to a Gaussian distribution. It provides:

• A single parameter μ (mean of the privacy loss distribution) as the privacy measure
• Tight composition bounds for subsampled Gaussian mechanisms without advanced composition theorems
• A central limit theorem for privacy that simplifies asymptotic analysis
• Particularly effective for large iteration counts common in deep learning

The accountant acts as a hard gatekeeper that halts training or query responses when the cumulative privacy loss reaches the pre-specified budget. Enforcement mechanisms include:

• Threshold checking: Before each query or training step, the accountant verifies remaining budget
• Adaptive stopping: Automatically terminates computation when ε_consumed ≥ ε_total
• Budget allocation strategies: Uniform distribution across steps, adaptive allocation based on gradient norms, or query-specific weighting
• Audit logging: Records all privacy expenditures for compliance verification and regulatory reporting

A critical optimization that the accountant must correctly model. When training examples are randomly sampled with probability q (e.g., via Poisson sampling), the privacy guarantee is amplified because an adversary cannot be certain if a target record was even processed. The accountant computes the amplified privacy loss by:

• Modeling the subsampled Gaussian mechanism's privacy loss distribution
• Accounting for the mixture distribution of the mechanism applied vs. not applied
• Leveraging amplification lemmas specific to the accounting framework (RDP, GDP, or moments) This amplification is essential for achieving practical privacy-utility tradeoffs in deep learning.

The quantified parameter in differential privacy that bounds the maximum privacy loss. The privacy accountant tracks cumulative epsilon expenditure across queries or training steps to ensure the total remains within a predefined limit. Smaller epsilon values enforce stronger privacy guarantees at the cost of model utility. A typical budget might be set at epsilon = 8 for training, with the accountant halting computation once exhausted.

A relaxation of pure differential privacy based on Rényi divergence that provides tighter composition bounds for tracking privacy loss. Privacy accountants use RDP as an intermediate accounting mechanism because it composes more accurately across iterative algorithms like DP-SGD. The accountant converts RDP bounds back to standard (ε, δ)-DP guarantees for final reporting.

The classic privacy accounting algorithm introduced with DP-SGD that tracks the log moment generating function of the privacy loss random variable. It computes tighter bounds than basic composition theorems by numerically evaluating moments at multiple orders and converting them to (ε, δ)-DP guarantees. The moments accountant was the breakthrough that made deep learning with differential privacy practical.

A privacy framework that characterizes privacy loss using hypothesis testing and f-divergences. The GDP accountant provides tight composition bounds for subsampled Gaussian mechanisms by leveraging the central limit theorem for privacy loss distributions. It often yields tighter epsilon estimates than RDP-based accounting when many iterations are involved.

The phenomenon where randomly sampling a subset of data before applying a differentially private mechanism yields a stronger privacy guarantee. The privacy accountant must incorporate Poisson sampling or shuffling amplification effects into its composition analysis. Without subsampling amplification, training deep models with tight privacy budgets would be infeasible.

The differentially private variant of stochastic gradient descent that clips per-sample gradients and adds Gaussian noise to the aggregated batch gradient. The privacy accountant tracks the cumulative privacy cost of each DP-SGD step, summing the epsilon expenditure across all training iterations. Modern implementations like Opacus and TensorFlow Privacy integrate the accountant directly into the optimizer loop.