Research map / Federated learning and privacy / Differential privacy
Beyond the Calibration Point: Mechanism Comparison in Differential Privacy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces the Δ-divergence, a metric-like approximate Blackwell comparison between differential privacy mechanisms that quantifies worst-case excess privacy vulnerability when mechanisms share an (ε, δ) point but differ elsewhere.
Problem
DP guarantees are usually reported and compared at a single (ε, δ) pair, but mechanisms with the same calibration point can differ substantially in privacy protection; the Blackwell theorem only applies when trade-off functions never cross, excluding DP-SGD.
Approach
Defines the Δ-divergence as the smallest horizontal/vertical shift making one trade-off function Blackwell dominate another, equivalently the max gap between minimum Bayes error functions; this gives approximate Blackwell dominance, a Bayesian interpretation with hyper-priors, a metric on DP mechanisms, and bounds on emergence of dominance under composition.
Key results
- Gaussian vs Laplace mechanisms (unit sensitivity) yield Δ-divergences 0.005 and 0.034 in the two directions, showing the Laplace mechanism is less regret-prone in the worst case.
- For SGMs calibrated to (8, 1e-5)-DP, Δ-divergence from a baseline grows monotonically with noise multiplier; the reported noise multiplier 3.0 is Pareto-efficient rather than optimal.
- Across SGMs calibrated to (8, 1e-5)-DP, Δ-divergence reaches about 0.12, which corresponds to roughly a 15% relative increase in data reconstruction attack success versus the baseline.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Choose Laplace (b=1) instead of Gaussian (σ=1) | Mechanism selection on a unit-sensitivity function · Unit-sensitivity function | worst-case Δ-divergence regret: 0.005 vs 0.034 | Helped |
| Apply Jeffreys hyper-prior Beta(0.5, 0.5) | Bayesian SGM comparison · Bayesian SGM comparison | weighted Δ-divergence: 0.01 < 0.02; 0.007 < 0.015 | No clear effect |
| Apply UQuadratic[0,1] hyper-prior | Bayesian SGM comparison · Bayesian SGM comparison | weighted Δ-divergence: 0.014 > 0 | Helped |
| Increase the SGM noise multiplier above σ̃=3 | CIFAR-10 DP-SGD training · CIFAR-10 validation | validation accuracy and excess vulnerability | Mixed |
| Increase the SGM noise multiplier | DP-SGD parameter sweep calibrated to (8, 10⁻⁵)-DP · DP-SGD parameter sweep | Δ-divergence: maximum ... around 0.12 | Hurt |
| Increase the sampling rate or number of steps | SGM relative to the baseline mechanism · DP-SGD parameter sweep calibrated to (8, 10⁻⁵)-DP | Δ-divergence: around 0.12 | Hurt |
| Increase Δ-divergence from 0 to 0.12 | SGM compared with the baseline mechanism · Data reconstruction attack | successful attack vulnerability: 0 to 0.12; 15\% | Hurt |
Surprising findings
- Mechanisms nominally calibrated to the same (8, 1e-5)-DP differ in excess vulnerability, and common practice of large sampling rates and many steps corresponds to the most vulnerable regime.
Limitations
- Divergence measures worst-case regret only; does not incorporate training cost or model utility directly
- Assumes mutually absolutely continuous dominating pairs and symmetric trade-off functions
- Empirical examples rely on previously published calibrations and bounds rather than new attacks
Experimental setup
Datasets: CIFAR-10 JFT-300M
Metrics: Delta-divergence Bayes error trade-off function reconstruction robustness upper bound
Baselines: Blackwell dominance (Dong et al.) single (epsilon, delta) calibration Type-II error at low alpha recommendation
Builds on: f-DP Blackwell theorem privacy profile Renyi DP DP-SGD
Closest papers by meaning
- 𝑓-Differential Privacy Filters: Validity and Approximate Solutions (NeurIPS 2026 · similarity 0.90)
- Setting $\varepsilon$ is not the Issue in Differential Privacy (NeurIPS 2025 · similarity 0.90)
- Unified Mechanism-Specific Amplification by Subsampling and Group Privacy Amplification (NeurIPS 2024 · similarity 0.88)
- The Limits of Differential Privacy in Online Learning (NeurIPS 2024 · similarity 0.88)
- Attack-Aware Noise Calibration for Differential Privacy (NeurIPS 2024 · similarity 0.88)
- The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.