Research map / Federated learning and privacy / Differential privacy
Leveraging Randomness in Model and Data Partitioning for Privacy Amplification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that structured randomness in training (random model-submodel assignment and balanced per-sample iteration selection) yields RDP privacy amplification via a mixture-of-Gaussians analysis, and proposes Balanced Iteration Subsampling as an alternative to Poisson sampling.
Problem
Existing privacy accounting does not capture the privacy amplification from structured randomness in training, such as random model partitioning (model parallelism, dropout) and fixed-count data subsampling, which are not i.i.d. Poisson subsampling.
Approach
Model each step's output as a uniform mixture of Gaussians over the possible submodel gradients and derive exact-ish RDP bounds for mixtures over k-subsets of d coordinates; apply this to disjoint/overlapping model splitting, dropout, and a new Balanced Iteration Subsampling in which each sample is used in exactly k of T iterations.
Key results
- For ResNet-101 model splitting with 8 submodels under centralized (8, 1e-5)-DP, privacy amplification accounting raises validation accuracy from 76.80% (baseline accounting) to 80.52%, with noise std reduced from 6.62e-4 to 4.96e-4.
- Balanced Iteration Subsampling and Poisson subsampling achieve nearly identical accuracy on CIFAR-10 (e.g., 70.21% vs 70.13% for WideResNet-40-4), with noise differing by under 1%.
- Balanced Iteration Subsampling's RDP bound is always at least as good as Poisson subsampling's when using the tighter bound, and the efficient bound beats Poisson when k/T is roughly above 0.2.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| model-splitting privacy amplification accounting (vs standard RDP accounting) | disjoint model splitting, 3 submodels, ResNet-101 fine-tuning · CIFAR-10 centralized (8,1e-5)-DP | validation accuracy: +2.63 points (79.80% to 82.43%) | Helped |
| model-splitting privacy amplification accounting (vs standard RDP accounting) | disjoint model splitting, 8 submodels, ResNet-101 fine-tuning · CIFAR-10 centralized (8,1e-5)-DP | validation accuracy: +3.72 points (76.80% to 80.52%) | Helped |
| model-splitting privacy amplification accounting (vs standard RDP accounting) | disjoint model splitting, 3 submodels, ResNet-101 fine-tuning · CIFAR-10 federated user-level (8,1e-5)-DP | validation accuracy: +1.81 points (78.47% to 80.28%) | Helped |
| model-splitting privacy amplification accounting (vs standard RDP accounting) | disjoint model splitting, 8 submodels, ResNet-101 fine-tuning · CIFAR-10 federated user-level (8,1e-5)-DP | validation accuracy: +2.15 points (76.96% to 79.11%) | Helped |
| model splitting into submodels (vs no splitting, full model) | ResNet-101 fine-tuning with DP · CIFAR-10 centralized (8,1e-5)-DP | validation accuracy: 84.99% no split vs 82.43% best split with amplification | Hurt |
| Balanced Iteration Subsampling (vs Poisson subsampling) | WideResNet-40-4 from scratch · CIFAR-10 (8,1e-5)-DP, 2000 iterations | validation accuracy: 70.21% vs 70.13% | No clear effect |
| Balanced Iteration Subsampling (vs Poisson subsampling) | ResNet-101 finetuning · CIFAR-10 (8,1e-5)-DP | validation accuracy: 84.86% vs 84.99% | No clear effect |
| Balanced Iteration Subsampling (vs Poisson subsampling) in RDP bound | privacy accounting, theoretical comparison · RDP privacy guarantee | epsilon(alpha) RDP | Helped |
| Model splitting with dropout-style 0.5 subnetworks accounted via Corollary (d=2,k=1) | dropout layers · theoretical | RDP epsilon | No clear effect |
Surprising findings
- Balanced Iteration Subsampling with k=1 gives an RDP expression matching a prior unpublished/concurrent analysis, and the authors note an earlier work appears to have used the Shuffle Gaussian Mechanism bound incorrectly.
Limitations
- Theoretical bounds are complicated and only numerically evaluable; tighter bound is computationally expensive.
- Model splitting analysis requires the partition to be known to the adversary and the submodel assignment to be secret; the probabilistic mixture bound may be loose.
- Experiments are limited to CIFAR-10 with ResNet-101 and WideResNet-40-4 and few random seeds.
Experimental setup
Datasets: CIFAR-10
Benchmarks: CIFAR-10
Metrics: validation accuracy noise standard deviation RDP epsilon (epsilon, delta)-DP
Baselines: Poisson subsampling accounting (RDP) PLD accounting (Google PLD library) standard RDP accounting for DP-SGD (no amplification) random check-ins
Builds on: DP-SGD Poisson subsampled Gaussian mechanism Rényi differential privacy random check-ins independent subnet training
Closest papers by meaning
- A Generalized Shuffle Framework for Privacy Amplification: Strengthening Privacy Guarantees and Enhancing Utility (AAAI 2024 · similarity 0.88)
- Privacy amplification by random allocation (NeurIPS 2025 · similarity 0.88)
- One-shot Empirical Privacy Estimation for Federated Learning (ICLR 2024 · similarity 0.88)
- FedLMT: Tackling System Heterogeneity of Federated Learning via Low-Rank Model Training with Theoretical Guarantees (ICML 2024 · similarity 0.88)
- Sampling-Free Privacy Accounting for Matrix Mechanisms under Random Allocation (NeurIPS 2026 · similarity 0.88)
- Privacy Amplification Persists under Unlimited Synthetic Data Release (NeurIPS 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.