How Do Input Attributes Impact the Privacy Loss in Differential Privacy?

TL;DR

This paper introduces a new metric called PLIS to analyze how individual input attributes influence privacy loss in differential privacy, enabling identification of sensitive data and high-risk subjects.

Contribution

It proposes the Privacy Loss-Input Susceptibility (PLIS) metric, linking input attributes to privacy loss in DP neural networks, and demonstrates its effectiveness in identifying sensitive attributes.

Findings

PLIS effectively quantifies attribute-specific privacy loss.

Sensitive attributes can be identified using PLIS.

Subjects at high risk of data reconstruction are detectable with PLIS.

Abstract

Differential privacy (DP) is typically formulated as a worst-case privacy guarantee over all individuals in a database. More recently, extensions to individual subjects or their attributes, have been introduced. Under the individual/per-instance DP interpretation, we study the connection between the per-subject gradient norm in DP neural networks and individual privacy loss and introduce a novel metric termed the Privacy Loss-Input Susceptibility (PLIS), which allows one to apportion the subject's privacy loss to their input attributes. We experimentally show how this enables the identification of sensitive attributes and of subjects at high risk of data reconstruction.