DP-SGD

Before averaging, the L2 norm of each individual gradient is bounded to a fixed threshold C. This limits the maximum influence any single training record can exert on the model update.

• Mechanism: g ← g * min(1, C / ||g||₂)
• Purpose: Bounds the sensitivity of the query, a prerequisite for meaningful noise calibration.
• Impact: Prevents outlier data points from dominating the gradient signal and leaking their presence.

Calibrated random noise drawn from a Gaussian distribution is added to the aggregated, clipped gradients. The noise scale σ is proportional to the clipping norm C and inversely proportional to the target privacy budget ε.

• Mechanism: g̃ ← (Σ clipped_grads + N(0, σ²C²I)) / batch_size
• Purpose: Masks the contribution of any single record, making its inclusion or exclusion statistically indistinguishable.
• Result: The output distribution satisfies (ε, δ)-differential privacy.

Randomly sampling a mini-batch from the full dataset at each step amplifies the privacy guarantee. An attacker cannot be certain if their target record was included in the batch or simply not sampled.

• Mechanism: Poisson sampling or uniform shuffling with fixed batch size.
• Effect: The effective ε is significantly lower than the per-iteration guarantee.
• Accounting: The Privacy Loss Distribution (PLD) or Rényi Differential Privacy (RDP) accountant tracks the composed privacy cost across all steps.

A privacy accounting technique that tracks the log moments of the privacy loss random variable to tightly bound the total composed ε across thousands of training iterations.

• Advantage: Provides significantly tighter bounds than the basic strong composition theorem.
• Successor: The Rényi Differential Privacy (RDP) accountant generalizes this approach for cleaner composition analysis.
• Output: Converts accumulated moments into a final (ε, δ) guarantee at a target δ (typically less than 1/N).

Computing per-sample gradients naively is prohibitively slow. Modern DP-SGD implementations use microbatching or vectorized operations to compute individual gradients efficiently within a larger batch.

• Technique: Groups of samples are processed to compute per-example gradients without a full forward-backward pass for each.
• Frameworks: Libraries like Opacus (Meta) and TensorFlow Privacy hook into PyTorch/TensorFlow autograd to enable high-throughput DP training.
• Trade-off: Increased memory footprint proportional to the microbatch size.

The clipping norm C and noise multiplier σ define a Pareto frontier between model accuracy and the privacy budget ε. Tuning these hyperparameters is critical for practical deployment.

• Low ε (ε < 1): Strong privacy, often requires aggressive clipping and high noise, degrading accuracy.
• High ε (ε > 8): Weaker formal guarantees but preserves more utility, suitable for less sensitive applications.
• Strategy: Use grid search over C and learning rate to find the optimal operating point for a target ε.

A critical preprocessing step in DP-SGD where the L2 norm of each per-sample gradient is bounded to a maximum threshold (C). This limits the sensitivity of any single training record to the model update. Without clipping, an outlier data point could exert an arbitrarily large influence, requiring infinite noise to mask. The clipped gradient is computed as g ← g * min(1, C / ||g||₂), ensuring no individual gradient exceeds the clipping norm before noise is added.

A quantifiable parameter controlling the maximum allowable information leakage. In DP-SGD, epsilon tracks the cumulative privacy cost across training steps. A smaller epsilon (e.g., ε = 0.1) provides a strong guarantee that the model's output is nearly indistinguishable whether or not a specific record was included. A larger epsilon (e.g., ε = 10) permits more information leakage. Selecting epsilon involves a trade-off between utility and privacy, often guided by the moments accountant.

A property where randomly sampling a batch of data for each training step amplifies the privacy guarantee. Because an attacker cannot know if a target record was included in any specific batch, the uncertainty of inclusion provides an additional layer of deniability. In DP-SGD, this amplification is analytically computed by the moments accountant. The amplification factor is proportional to the sampling ratio (q = batch_size / dataset_size), with smaller ratios yielding stronger amplification.

A relaxation of pure differential privacy based on Rényi divergence that provides tighter composition bounds than the original moments accountant. RDP defines privacy using two parameters (α, ε) and is particularly well-suited for analyzing the Gaussian mechanism used in DP-SGD. Converting RDP guarantees back to standard (ε, δ)-DP is straightforward via a conversion lemma, making RDP the preferred accounting framework in modern DP libraries like Opacus and TF Privacy.

The probability of catastrophic privacy failure in approximate differential privacy. While epsilon bounds the privacy loss ratio, delta allows for a small probability that the guarantee is completely broken. In DP-SGD, delta is typically set to be cryptographically small—much smaller than the inverse of the dataset size (δ ≪ 1/N). This ensures that the mechanism does not catastrophically leak a record, even if the epsilon guarantee is momentarily exceeded.