Auditing Differentially Private Machine Learning: How Private is Private SGD?

TL;DR

This paper empirically evaluates the actual privacy guarantees of Differentially Private SGD using novel data poisoning attacks, revealing potential gaps between theoretical guarantees and practical privacy.

Contribution

It introduces a new empirical approach using data poisoning to assess the real-world privacy of DP-SGD, bridging the gap between theory and practice.

Findings

Data poisoning attacks can compromise DP-SGD privacy in practice.

Practical privacy may be weaker than theoretical guarantees suggest.

Empirical methods can inform and improve privacy analysis.

Abstract

We investigate whether Differentially Private SGD offers better privacy in practice than what is guaranteed by its state-of-the-art analysis. We do so via novel data poisoning attacks, which we show correspond to realistic privacy attacks. While previous work (Ma et al., arXiv 2019) proposed this connection between differential privacy and data poisoning as a defense against data poisoning, our use as a tool for understanding the privacy of a specific mechanism is new. More generally, our work takes a quantitative, empirical approach to understanding the privacy afforded by specific implementations of differentially private algorithms that we believe has the potential to complement and influence analytical work on differential privacy.