Comparing privacy notions for protection against reconstruction attacks in machine learning

TL;DR

This paper develops a foundational framework to compare different privacy notions, such as $(psilon, elta)$-DP and metric privacy, in machine learning, especially against reconstruction attacks in federated learning.

Contribution

It introduces a comparison framework using Renyi differential privacy and Bayes' capacity to evaluate privacy guarantees across different mechanisms.

Findings

Provides a method to compare privacy notions using Renyi DP.

Uses Bayes' capacity as a measure of reconstruction threat.

Facilitates fair evaluation of privacy mechanisms in federated learning.

Abstract

Within the machine learning community, reconstruction attacks are a principal concern and have been identified even in federated learning (FL), which was designed with privacy preservation in mind. In response to these threats, the privacy community recommends the use of differential privacy (DP) in the stochastic gradient descent algorithm, termed DP-SGD. However, the proliferation of variants of DP in recent years\textemdash such as metric privacy\textemdash has made it challenging to conduct a fair comparison between different mechanisms due to the different meanings of the privacy parameters $\epsilon$ and $\delta$ across different variants. Thus, interpreting the practical implications of $\epsilon$ and $\delta$ in the FL context and amongst variants of DP remains ambiguous. In this paper, we lay a foundational framework for comparing mechanisms with differing notions of privacy guarantees, namely $(\epsilon,\delta)$-DP and metric privacy. We provide two foundational means of comparison: firstly, via the well-established $(\epsilon,\delta)$-DP guarantees, made possible through the R\'enyi differential privacy framework; and secondly, via Bayes' capacity, which we identify as an appropriate measure for reconstruction threats.