differential privacy

Existing differentially private (DP) noise mechanisms—particularly the Gaussian mechanism—lack a principled theoretical foundation for why β = 2 is empirically optimal in frameworks like PATE and DP-SGD. Method: This work systematically investigates the Generalized Gaussian (GG) mechanism (with shape parameter β ∈ [1, 2]) for privacy-preserving machine learning. We formally prove that the entire GG family satisfies (ε, δ)-differential privacy, and introduce a dimension-agnostic Privacy Random Variable (PRV)-based accounting framework that reduces privacy loss computation complexity from O(d) to O(1). Contribution/Results: Our theoretical analysis shows that tuning β yields only marginal utility gains, explaining the empirical dominance of the Gaussian mechanism (β = 2). Extensive experiments confirm that β ≈ 2 achieves the optimal trade-off between model accuracy and privacy budget consumption. The work provides a unified theoretical framework and empirical validation for selecting DP noise mechanisms.

Differential privacy (DP) gradient training suffers from excessive noise injection and suboptimal privacy–utility trade-offs due to reliance on global sensitivity, which is overly conservative for modern deep models. Method: This paper proposes the first scalable and verifiable framework for computing upper bounds on both local and smooth sensitivity—novelly integrating convex relaxation with interval-bound propagation to enable precise, efficient estimation of smooth sensitivity during gradient computation in contemporary deep neural networks. Contribution/Results: Our approach overcomes longstanding theoretical and computational barriers in rigorously bounding sensitivity. Experiments across financial risk assessment, medical image classification, and multi-task NLP demonstrate that our method reduces required noise magnitude by an order of magnitude, yielding substantial improvements in prediction accuracy and practical utility under identical privacy budgets (e.g., ε = 2, δ = 10⁻⁵). The framework provides stronger theoretical guarantees for private inference while ensuring engineering feasibility and scalability.

Balancing privacy preservation and model accuracy remains challenging in collaborative modeling among multiple data owners. Method: This paper proposes a novel framework that deeply integrates differential privacy (DP) with secure multi-party computation (MPC). It is the first to provably inject Laplacian noise directly within an MPC protocol—performing privacy-parameter perturbation under secret sharing during distributed gradient computation. This ensures strict ε-differential privacy guarantees while avoiding the accuracy degradation typically caused by global noise in conventional DP approaches. Contribution/Results: The method enables privacy-preserving joint training on highly sensitive data (e.g., genomic data) without exposing raw samples. It achieved first place in the iDASH 2021 Track III competition, significantly outperforming pure-DP baselines in accuracy. By unifying formal privacy guarantees with practical efficiency, this work establishes a new paradigm for privacy-enhancing technologies that simultaneously satisfies rigorous security requirements and real-world usability.

To address the low accuracy, poor calibration, and hyperparameter sensitivity of differentially private (DP) regression models in high-stakes settings, this paper proposes DPConvCNP—a novel framework that integrates meta-learning with a refined functional differential privacy mechanism (building upon Hall et al., 2013) to enable one-shot mapping from private data to DP prediction models. Leveraging Convolutional Conditional Neural Processes (ConvCNPs) as its backbone, DPConvCNP supports non-Gaussian data modeling. Under strict ε-DP guarantees, it substantially outperforms tuned DP Gaussian process baselines in both predictive accuracy and calibration quality, achieves a 10× speedup in inference, and exhibits markedly reduced sensitivity to hyperparameters.

Differential privacy (DP) mechanisms are commonly reported at a single $(varepsilon,delta)$ point, obscuring substantial differences in actual privacy risk among mechanisms sharing identical $(varepsilon,delta)$ parameters—leading to systematic underestimation of risk. Method: We propose a unified quantification framework grounded in $Delta$-divergence, integrating f-differential privacy, Bayesian privacy interpretations, and Blackwell order theory for the first time to establish a decision-theoretically principled paradigm for comparing DP mechanisms. Contribution/Results: By rigorously characterizing worst-case privacy vulnerability disparities, we expose non-negligible excess risk in mainstream noise mechanisms used in DP-SGD. Our framework yields a verifiable, ordinal privacy strength assessment tool—enabling rigorous, theoretically grounded selection of privacy-preserving mechanisms.

This work addresses a critical discrepancy in the privacy analysis of existing DP-SGD implementations: due to gradient averaging, their actual mechanisms align more closely with the Expected Average Stochastic Gradient Mechanism (EASGM) or Average Stochastic Gradient Mechanism (ASGM) rather than the standard Stochastic Gradient Mechanism (SGM). Consequently, conventional SGM-based privacy analyses overstate the privacy guarantees. The paper is the first to explicitly distinguish between these gradient averaging strategies in DP-SGD and rigorously analyze their impact on privacy loss. It provides refined theoretical bounds and empirical privacy audits based on variants of the Subsampled Gaussian Mechanism—specifically EASGM and ASGM—and formally proves that their privacy guarantees are strictly weaker than those of SGM. Empirical evaluation across four widely used implementations reveals privacy leakage exceeding SGM assumptions, and the study establishes tight, corrected privacy bounds for the latest version of Opacus.

This work addresses the limitation of existing single-run differential privacy (DP) auditing methods, which yield loose lower bounds on privacy leakage due to information loss from binarizing sentinel signals. Focusing on DP machine learning algorithms such as DP-SGD, the paper proposes an efficient single-run auditing framework that leverages the distributional properties of sequences of sentinel signals. It establishes, for the first time, that normalized aligned sentinel signals asymptotically follow a Gaussian distribution, and builds upon this insight a Gaussian approximation auditing method grounded in the Central Limit Theorem. Requiring only a single training run, the proposed approach achieves substantially tighter lower bounds on privacy leakage compared to current techniques, thereby significantly enhancing both the accuracy and practicality of DP auditing.

This work addresses three key challenges in differentially private statistical estimation of black-box functions: unknown sensitivity, low query efficiency, and suboptimal data utilization. We propose the first general framework that achieves both statistical and oracle query efficiency without prior knowledge of sensitivity. Our method integrates an adaptive querying mechanism with customized noise injection, guaranteeing ε-differential privacy while drastically reducing dependence on function evaluations—scaling far better than exponential in the problem parameters. We establish a tight theoretical lower bound on the privacy–utility trade-off and prove that our framework attains this bound. Empirical evaluation across multiple benchmark tasks demonstrates that our approach achieves higher estimation accuracy with significantly fewer oracle queries compared to existing differentially private black-box estimators.

This work addresses critical limitations of the conventional discrete Gaussian mechanism in differential privacy, which is vulnerable to floating-point precision issues and demands substantial high-quality randomness. The authors propose the dithered Gaussian mechanism, which decouples randomness into a privacy-critical high-quality component and a non-critical, computationally efficient component through output-side discretization and dual-source randomization. This approach preserves the theoretical privacy guarantees of the standard Gaussian mechanism while eliminating floating-point security vulnerabilities. Notably, it drastically reduces the requirement for high-quality random bits—rendering this demand independent of noise magnitude—and enables cryptographically secure noise generation in DP-SGD with minimal computational overhead, thereby achieving a strong balance between security and practicality.

This work addresses a central challenge in differential privacy: enhancing algorithmic utility without compromising privacy guarantees or incurring excessive computational complexity. The authors propose a post-processing denoising method grounded in empirical Bayes estimation, which effectively reduces mean squared error using only the outputs of Gaussian differential privacy mechanisms. To the best of our knowledge, this is the first systematic application of the empirical Bayes framework to differential privacy post-processing. The approach significantly improves utility without altering the underlying privacy mechanism, offering both simplicity and broad applicability. Empirical evaluations demonstrate consistent performance gains over existing differentially private algorithms across diverse tasks, including histogram release, principal component analysis, and linear regression.