Research map / Time series / Causal and generative time series
Privacy Amplification by Structured Subsampling for Deep Differentially Private Time Series Forecasting
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives tight event- and user-level DP-SGD privacy guarantees for structured bi-level subsampling (sequence and subsequence sampling plus context-forecast split) in deep time series forecasting, and shows neural forecasters retain utility under strong privacy.
Problem
Standard DP-SGD privacy amplification assumes unstructured random batches, which does not match how time series forecasting batches are formed (contiguous subsequences from sampled sequences, split into context and forecast), so existing guarantees may misestimate privacy.
Approach
Analyzes privacy amplification from structured subsampling: bottom-level sampling of contiguous subsequences, top-level sampling of sequences, and context-forecast split with Gaussian data augmentation, using coupling-based dominating pairs to derive tight per-step and per-epoch bounds.
Key results
- On traffic with 1-event-level privacy and delta=1e-7, DeepAR reaches average CRPS 0.157 at epsilon=0.5 versus 0.124 non-private, outperforming AutoETS (0.407) and seasonal naive (0.251).
- Lambda=1 (one subsequence per sequence) gives smaller delta(epsilon) than lambda>1 for the same number of composed steps, even under optimistic lower bounds for lambda>1.
- Top-level sampling without replacement yields stronger epoch-level privacy than deterministic iteration despite requiring more compositions per epoch.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train DeepAR with ε=0.5 event-level privacy instead of non-private training | DeepAR · traffic test | CRPS: 0.124 -> 0.157 | Hurt |
| Use λ=1 rather than λ>1 subsequences per sequence (ablation) | structured subsampling · privacy accounting after 100 training steps | δ(ε) | Helped |
| Sample sequences without replacement instead of deterministic top-level iteration (ablation) | structured subsampling with λ=1 · privacy accounting after 1 step, 1 epoch, and 10 epochs | privacy | Helped |
| Add online Gaussian label perturbation (ablation) | self-supervised sequence training · privacy amplification | privacy | Helped |
Surprising findings
- Sampling sequences with replacement at top level is not needed; deterministic iteration over sequences gives weaker privacy than sampling without replacement even though it needs fewer compositions per epoch.
- Using multiple subsequences per sequence (lambda>1) yields worse privacy under composition than lambda=1 even though it appears to be a natural generalization.
Limitations
- Bounds for bottom-level sampling with replacement and lambda>1 and for top-level WOR with lambda>1 are not tight.
- Lower bound for lambda>1 may not be a tight upper bound, so the comparison is against optimistic baselines.
- Experiments limited to three datasets and four architectures; analysis restricted to univariate series in the main text.
Experimental setup
Datasets: traffic electricity solar_10_minutes
Benchmarks: traffic electricity solar_10_minutes
Metrics: CRPS (mean weighted quantile loss)
Baselines: SimpleFeedForward DeepAR iTransformer DLinear Seasonal naive AutoETS
Builds on: DP-SGD dominating pairs subsampled coupling analysis privacy loss distribution accounting
Closest papers by meaning
- Certification for Differentially Private Prediction in Gradient-Based Training (ICML 2025 · similarity 0.88)
- Differentially Private Stochastic Gradient Descent with Fixed-Size Minibatches: Tighter RDP Guarantees with or without Replacement (NeurIPS 2024 · similarity 0.88)
- Leveraging Randomness in Model and Data Partitioning for Privacy Amplification (ICML 2025 · similarity 0.86)
- Privacy without Noisy Gradients: Slicing Mechanism for Generative Model Training (NeurIPS 2024 · similarity 0.86)
- Scalable DP-SGD: Shuffling vs. Poisson Subsampling (NeurIPS 2024 · similarity 0.86)
- Unified Mechanism-Specific Amplification by Subsampling and Group Privacy Amplification (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.