Gradient Clipping

The core mechanism involves computing the L2 norm (Euclidean length) of each per-sample gradient vector. If the norm exceeds a predefined clipping threshold (C), the gradient is scaled down proportionally to have a norm exactly equal to C. This ensures no single data point can contribute a gradient of magnitude greater than C, directly limiting the sensitivity of the minibatch gradient.

Clipping strategies vary in sophistication:

• Flat Clipping: Uses a single, fixed threshold C for all layers and training steps. Simple but can be suboptimal.
• Layer-wise Clipping: Applies distinct thresholds to different layers, accounting for varying gradient scales.
• Adaptive Clipping: Dynamically adjusts the threshold during training, often based on a target quantile of the observed gradient norm distribution, reducing the need for manual tuning.

Gradient clipping directly defines the L2 sensitivity of the query 'compute the average gradient.' In DP-SGD, the sensitivity is exactly the clipping threshold C. This value is a critical input to the Gaussian mechanism: noise with a standard deviation proportional to C is added to the aggregated gradient. A smaller C reduces sensitivity and requires less noise for the same privacy budget (ε), but overly aggressive clipping can destroy the learning signal.

Clipping introduces a tension between privacy and utility:

• Low Threshold: Strong privacy guarantee (low sensitivity) but introduces significant bias by distorting the true gradient direction, potentially preventing convergence.
• High Threshold: Preserves more of the true gradient (low bias) but increases sensitivity, requiring more noise to achieve the same privacy level, which increases variance. The optimal threshold balances this trade-off, often found through hyperparameter tuning on a validation set.

A key implementation detail is that clipping must be applied per-sample, not to the averaged minibatch gradient. This requires computing gradients for each example individually before averaging, which is computationally more expensive than standard SGD. Modern frameworks like Opacus and TensorFlow Privacy implement efficient vectorized per-sample gradient computation to make this feasible for deep networks.

By capping the maximum influence of any single outlier or unique training example, gradient clipping directly combats memorization. Without clipping, a model might take an extremely large step to fit a rare, potentially sensitive data point. Clipping ensures that the model's update from any one example is bounded, making it harder for the model to encode exact copies of training data and reducing vulnerability to membership inference attacks.

A mathematical framework that provides provable privacy guarantees by injecting calibrated noise into computations. The output is statistically indistinguishable whether or not any single individual's data is included.

• Epsilon (ε): The privacy budget parameter controlling information leakage
• Delta (δ): The probability of catastrophic privacy failure
• Provides a formal, quantifiable definition of privacy loss

A quantifiable parameter (ε) that controls the maximum allowable information leakage from a differentially private mechanism. A smaller epsilon indicates a stronger privacy guarantee.

• Composition: Privacy loss accumulates across multiple queries or training steps
• Moments Accountant: Tracks the total privacy expenditure during DP-SGD training
• Budget exhaustion triggers the termination of further data access

An adversarial method that determines whether a specific data record was included in a model's training dataset. Attackers exploit prediction confidence gaps and loss values between training and non-training samples.

• Shadow models are trained to mimic target behavior and generate labeled attack data
• Gradient clipping in DP-SGD directly reduces the signal exploited by MIAs
• Represents the primary threat that clipping and noising are designed to neutralize

The property where randomly sampling a subset of data for each training step amplifies the privacy guarantee. The uncertainty of whether a specific record was included in any given batch provides an additional layer of deniability.

• Works synergistically with gradient clipping in DP-SGD
• Amplification factor is proportional to the sampling ratio
• Enables tighter privacy accounting without increasing noise

A relaxation of pure differential privacy based on Rényi divergence that provides tighter composition bounds for iterative algorithms like DP-SGD. RDP enables more accurate tracking of privacy loss across thousands of training steps.

• Converts to standard (ε, δ)-DP bounds after accounting
• Supports subsampled mechanisms natively
• Reduces the total noise required compared to strong composition theorems