DP-SGD

The foundational sensitivity-bounding step. Instead of computing a single average gradient for a batch, DP-SGD computes the gradient for each individual example independently. Each per-sample gradient vector is then clipped to a maximum L2 norm (a clipping threshold C). This ensures that no single data point can contribute a gradient with a magnitude greater than C, strictly limiting the maximum possible influence of any individual record on the model update.

After clipping and aggregating the per-sample gradients into a single batch gradient, calibrated random noise is added. This noise is sampled from a Gaussian distribution with a standard deviation proportional to the clipping threshold C and inversely proportional to the target privacy budget epsilon. This step masks the precise contribution of any single example, converting a deterministic update into a randomized mechanism that satisfies the mathematical definition of differential privacy.

A sophisticated privacy accounting technique used to track the total privacy loss (epsilon) over many iterative training steps. Unlike basic composition theorems, the Moments Accountant computes a tight bound on the privacy loss random variable by tracking the log moments of the privacy loss distribution. This provides a much more accurate estimate of the total privacy budget consumed, allowing for significantly more training iterations under the same final epsilon guarantee compared to naive strong composition.

A quantifiable, tunable parameter that defines the strength of the privacy guarantee. A lower epsilon (e.g., ε = 0.1) provides a stronger guarantee but adds more noise, reducing model utility. A higher epsilon (e.g., ε = 8.0) adds less noise but provides a weaker guarantee. The budget is consumed with each training step, and training must stop once the pre-defined total epsilon is exhausted. This provides a formal, mathematical dial to trade off between privacy and accuracy.

A privacy amplification technique where each training step operates on a random subset (a mini-batch) of the full dataset, sampled with a fixed probability q. The randomness of whether a specific data point is included in a batch adds an additional layer of uncertainty for an adversary. This privacy amplification by subsampling effectively reduces the privacy cost of each step, allowing for a much lower total epsilon for the same number of iterations compared to processing the full dataset.

Standard SGD computes the average gradient for a batch directly, which can leak information about the batch's constituents. DP-SGD fundamentally alters this process:

• Gradient computation: Standard SGD computes a single batch gradient; DP-SGD computes and clips per-sample gradients.
• Update rule: Standard SGD updates weights with the raw average gradient; DP-SGD updates weights with a clipped, aggregated, and noised gradient.
• Computational cost: DP-SGD is significantly more computationally expensive due to the requirement to backpropagate individually for each sample in a batch.

The foundational operation within DP-SGD that bounds the sensitivity of each training example. Before noise is added, the L2 norm of every individual gradient is computed. If the norm exceeds a predefined clipping threshold C, the gradient is scaled down to have norm exactly C. This ensures no single data point can exert disproportionate influence on the model update, a prerequisite for meaningful differential privacy guarantees.

A quantifiable metric controlling the privacy loss in DP-SGD. Epsilon defines the strength of the guarantee: a lower epsilon (e.g., ε = 0.1) provides strong privacy but may degrade utility, while a higher epsilon (e.g., ε = 10) permits more information leakage. The budget is consumed cumulatively across training iterations, tracked via a privacy accountant that computes the total ε and δ (failure probability) spent.

After per-sample clipping, DP-SGD injects calibrated Gaussian noise into the aggregated gradient. The noise scale is proportional to the clipping threshold C and inversely proportional to the target privacy budget ε. This mechanism satisfies (ε, δ)-differential privacy by ensuring the output distribution of the training step is statistically nearly indistinguishable whether any single record is included or excluded from the batch.

A critical component that tracks the cumulative privacy loss across all training iterations. The accountant uses advanced composition theorems—such as Rényi Differential Privacy (RDP) or Moments Accountant—to provide tight bounds on the total (ε, δ) consumed. This prevents silent budget overruns and allows practitioners to halt training precisely when the desired privacy level is reached.

The primary threat that DP-SGD defends against. In federated or distributed settings, an honest-but-curious server can reconstruct private training inputs by solving an optimization problem that matches dummy gradients to the shared aggregated gradient. DP-SGD's noise injection and clipping directly degrade the fidelity of these reconstructions, making pixel-accurate recovery computationally infeasible.

An alternative to DP-SGD for private training. Private Aggregation of Teacher Ensembles trains an ensemble of teacher models on disjoint partitions of sensitive data. A student model is then trained on the noisy aggregated votes of the teachers, transferring only privacy-protected knowledge. While DP-SGD protects the training algorithm itself, PATE protects the labels used for knowledge transfer.