Ball Differential Privacy: How to Mitigate Data Reconstruction with Less Noise

2026-07-05

AI Summary

This work addresses the excessive noise introduced by traditional differential privacy (DP) mechanisms in defending against data reconstruction attacks, which severely degrades model utility, despite the fact that practical attacks typically modify only records within a local neighborhood. To this end, the authors propose Ball-DP, a novel mechanism that restricts privacy-preserving perturbations to a spherical neighborhood of radius \( r \) in the embedding space, defining privacy based on a local distance metric and calibrating noise accordingly. They also develop Ball-ReRo, a corresponding certification framework for reconstruction robustness, validated through optimal maximum-a-posteriori (MAP) attack modeling and empirical auditing. Experiments across seven benchmark tasks demonstrate that, under strong privacy guarantees, Ball-DP substantially outperforms conventional DP—achieving significantly lower noise injection while maintaining or even improving both reconstruction robustness and model accuracy.

Abstract

Vector embeddings of raw records, while not human-readable, do not preserve record privacy: an adversary can reconstruct training records from a released model even when that model is a simple convex classifier. Differential privacy (DP) is the principled defense, but its noise is calibrated to worst-case indistinguishability, hiding arbitrary single-record substitutions, including those far outside the set of plausible alternatives relevant to a reconstruction adversary. The result is noise far larger than what reconstruction robustness requires, degrading accuracy without a corresponding security benefit. We propose Ball-DP: enforcing epsilon-delta indistinguishability over single-record substitutions restricted to a ball of radius r under a distance metric d in the embedding space. A deployment facing only local reconstruction threats can choose a small r, thereby reducing noise and recovering accuracy. The radius makes the scope of the privacy claim explicit against reconstruction attacks; standard DP is recovered when r covers the entire admissible record domain. We provide noise calibrations for regularized convex learning problems under Ball-DP, and derive corresponding reconstruction-robustness certificates, called Ball-ReRo, that upper-bound an attacker's reconstruction success. By deriving the optimal finite-prior MAP reconstruction attack, we empirically audit Ball-ReRo certificates on seven benchmark learning tasks. Our experiments show that calibrating noise to Ball-DP improves utility, considerably exceeding the dilution of reconstruction robustness in high-privacy regimes, i.e., when epsilon is small.

Problem

• data reconstruction
• differential privacy
• privacy-preserving machine learning
• noise calibration
• embedding space

Innovation

• Ball-DP
• differential privacy
• data reconstruction
• privacy-utility tradeoff
• embedding space