This paper investigates the privacy guarantees of different batch sampling methods used in Differentially Private Stochastic Gradient Descent (DP-SGD), specifically comparing deterministic batching (D), Poisson subsampling (P), and shuffling (S). The study reveals significant differences in privacy analysis depending on the batch sampling method, highlighting that the choice of sampling method can greatly affect the privacy guarantees of DP-SGD.
The paper shows that shuffling-based DP-SGD provides stronger privacy guarantees than deterministic batching, but the privacy analysis for shuffling is not as well understood as that for Poisson subsampling. In contrast, Poisson subsampling-based DP-SGD has a well-understood privacy analysis, but is less scalable in practice. The paper demonstrates that using the privacy analysis of Poisson subsampling for shuffling-based DP-SGD can lead to a significant underestimation of the actual privacy loss.
The study also shows that the privacy guarantees of ABLQ mechanisms vary depending on the batch sampling method. For example, ABLQ with shuffling (S) provides stronger privacy guarantees than ABLQ with deterministic batching (D), but the privacy guarantees of ABLQ with Poisson subsampling (P) can be worse than those of ABLQ with deterministic batching for large values of ε. Additionally, the privacy guarantees of ABLQ with shuffling can be significantly worse than those of ABLQ with Poisson subsampling in certain regimes.
The paper concludes that the choice of batch sampling method has a significant impact on the privacy guarantees of DP-SGD. Practitioners should be cautious when reporting privacy parameters for DP-SGD, as the actual privacy guarantees can vary significantly depending on the batch sampling method used. The study also highlights the need for more research into the privacy guarantees of different batch sampling methods and the development of tighter privacy accounting methods for DP-SGD.This paper investigates the privacy guarantees of different batch sampling methods used in Differentially Private Stochastic Gradient Descent (DP-SGD), specifically comparing deterministic batching (D), Poisson subsampling (P), and shuffling (S). The study reveals significant differences in privacy analysis depending on the batch sampling method, highlighting that the choice of sampling method can greatly affect the privacy guarantees of DP-SGD.
The paper shows that shuffling-based DP-SGD provides stronger privacy guarantees than deterministic batching, but the privacy analysis for shuffling is not as well understood as that for Poisson subsampling. In contrast, Poisson subsampling-based DP-SGD has a well-understood privacy analysis, but is less scalable in practice. The paper demonstrates that using the privacy analysis of Poisson subsampling for shuffling-based DP-SGD can lead to a significant underestimation of the actual privacy loss.
The study also shows that the privacy guarantees of ABLQ mechanisms vary depending on the batch sampling method. For example, ABLQ with shuffling (S) provides stronger privacy guarantees than ABLQ with deterministic batching (D), but the privacy guarantees of ABLQ with Poisson subsampling (P) can be worse than those of ABLQ with deterministic batching for large values of ε. Additionally, the privacy guarantees of ABLQ with shuffling can be significantly worse than those of ABLQ with Poisson subsampling in certain regimes.
The paper concludes that the choice of batch sampling method has a significant impact on the privacy guarantees of DP-SGD. Practitioners should be cautious when reporting privacy parameters for DP-SGD, as the actual privacy guarantees can vary significantly depending on the batch sampling method used. The study also highlights the need for more research into the privacy guarantees of different batch sampling methods and the development of tighter privacy accounting methods for DP-SGD.