aiqbench analysis
This paper proposes adopting non-asymptotic Gaussian Differential Privacy (GDP) as a superior standard for reporting privacy guarantees in machine learning. By leveraging numerical accountants and decision-theoretic metrics, the authors demonstrate that GDP accurately captures complex privacy profiles where traditional $(\varepsilon, \delta)$ parameters often mislead regarding inference attack risks. The approach offers a more rigorous framework for evaluating algorithms like DP-SGD without relying on asymptotic approximations that may not hold in practical scenarios.
Gaussian DP for Reporting Differential Privacy Guarantees in Machine Learning
arXiv:2503.10945v3 Announce Type: replace Abstract: Current practices for reporting differential privacy (DP) guarantees for machine learning (ML) algorithms such as DP-SGD provide an incomplete and potentially misleading picture. For instance, if only a single $(\varepsilon, \delta)$ is known about a mechanism, standard analyses show that there could exist highly accurate inference attacks against training data records, when, upon a more careful analysis, such accurate attacks do not exist for most practical mechanisms. In this position paper, we argue that using _non-asymptotic_ Gaussian Differential Privacy (GDP) as the primary means of communicating DP guarantees in ML avoids these potential downsides. Using two recent developments in the DP literature: (i) open-source numerical accountants capable of computing the privacy profile and $f$-DP curves of DP-SGD to arbitrary accuracy, and (ii) a decision-theoretic metric over DP representations, we show how to provide non-asymptotic bounds on GDP using numerical accountants, and show that GDP can capture the entire privacy profile of DP-SGD and related algorithms with virtually no error, as quantified by the metric. To support our claims, we investigate the privacy profiles of state-of-the-art DP large-scale image classification, and the TopDown algorithm for the U.S. Decennial Census, observing that GDP fits their profiles remarkably well in all cases. We conclude with a discussion on the strengths and weaknesses of this approach, and discuss which other privacy mechanisms could benefit from GDP.
Abstract:Current practices for reporting differential privacy (DP) guarantees for machine learning (ML) algorithms such as DP-SGD provide an incomplete and potentially misleading picture. For instance, if only a single $(\varepsilon, \delta)$ is known about a mechanism, standard analyses show that there could exist highly accurate inference attacks against training data records, when, upon a more careful analysis, such accurate attacks do not exist for most practical mechanisms. In this position paper, we argue that using _non-asymptotic_ Gaussian Differential Privacy (GDP) as the primary means of communicating DP guarantees in ML avoids these potential downsides. Using two recent developments in the DP literature: (i) open-source numerical accountants capable of computing the privacy profile and $f$-DP curves of DP-SGD to arbitrary accuracy, and (ii) a decision-theoretic metric over DP representations, we show how to provide non-asymptotic bounds on GDP using numerical accountants, and show that GDP can capture the entire privacy profile of DP-SGD and related algorithms with virtually no error, as quantified by the metric. To support our claims, we investigate the privacy profiles of state-of-the-art DP large-scale image classification, and the TopDown algorithm for the U.S. Decennial Census, observing that GDP fits their profiles remarkably well in all cases. We conclude with a discussion on the strengths and weaknesses of this approach, and discuss which other privacy mechanisms could benefit from GDP.
Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Machine Learning (stat.ML)
arXiv:2503.10945 [cs.LG]
(or arXiv:2503.10945v3 [cs.LG] for this version)
Full text under the publisher's open licence · 243 words
Related coverage
Protect Your Score: Contact Tracing With Differential Privacy Guarantees
arXiv · Sep 14, 2026
Private and Distributionally Robust Federated Multiclass Classification
arXiv · Oct 12, 2026
Task-aware Kernel Stein certificates for R\'{e}nyi differential privacy
arXiv · Oct 19, 2026
Learning to Approximate Uniform Facility Location via Graph Neural Networks
arXiv · Sep 24, 2026