Sampling-Free Privacy Accounting for Matrix Mechanisms under Random Allocation

TL;DR

This paper introduces a sampling-free method for privacy accounting in matrix mechanisms under random allocation, improving accuracy and efficiency over previous sampling-based approaches.

Contribution

We develop novel bounds based on Rényi divergence and conditional composition, applicable to arbitrary matrices, with a dynamic programming approach for efficient computation.

Findings

Our bounds outperform sampling-based methods in accuracy.

The approach applies to a wide class of matrix mechanisms.

Numerical results demonstrate broad applicability and improved privacy guarantees.

Abstract

We study privacy amplification for differentially private model training with matrix factorization under random allocation (also known as the balls-in-bins model). Recent work by Choquette-Choo et al. (2025) proposes a sampling-based Monte Carlo approach to compute amplification parameters in this setting. However, their guarantees either only hold with some high probability or require random abstention by the mechanism. Furthermore, the required number of samples for ensuring $(\epsilon,\delta)$-DP is inversely proportional to $\delta$. In contrast, we develop sampling-free bounds based on R\'enyi divergence and conditional composition. The former is facilitated by a dynamic programming formulation to efficiently compute the bounds. The latter complements it by offering stronger privacy guarantees for small $\epsilon$, where R\'enyi divergence bounds inherently lead to an over-approximation. Our framework applies to arbitrary banded and non-banded matrices. Through numerical comparisons, we demonstrate the efficacy of our approach across a broad range of matrix mechanisms used in research and practice.