Show & Tell: Phase 38.2 DifferentialPrivacyEngine — DP-SGD, Rényi DP & Moments Accountant

[web3guru888]

Show & Tell: DifferentialPrivacyEngine (Phase 38.2)

Differential Privacy Fundamentals

A randomized mechanism M satisfies (ε,δ)-differential privacy if for all adjacent datasets D, D' (differing in one record) and all measurable sets S:

Pr[M(D) ∈ S] ≤ eᵋ · Pr[M(D') ∈ S] + δ

Gaussian Mechanism

For a function f with L2 sensitivity Δf:

M(D) = f(D) + N(0, σ²I)
where σ = Δf · √(2 ln(1.25/δ)) / ε

For DP-SGD (Abadi et al., 2016):
1. Clip per-sample gradients: ḡᵢ = gᵢ · min(1, C/‖gᵢ‖₂)
2. Aggregate: ḡ = (1/L)(Σᵢ ḡᵢ + N(0, σ²C²I))
3. Sensitivity = C (the clipping bound)

Rényi Differential Privacy

Mironov (2017) introduced RDP for tighter composition:

Dα(M(D) ‖ M(D')) ≤ ε

where Dα is the Rényi divergence of order α:
Dα(P‖Q) = 1/(α-1) · log E_Q[(P/Q)^α]

For Gaussian mechanism with σ:
εRDP(α) = α/(2σ²)

Conversion to (ε,δ)-DP:
ε = εRDP(α) + log(1/δ)/(α-1) - log(α)/(α-1)
(optimize over α)

Moments Accountant

def compute_privacy_spent(noise_multiplier, sampling_rate, num_steps, target_delta):
    """Compute (ε,δ)-DP guarantee using moments accountant."""
    orders = [1 + x / 10.0 for x in range(1, 100)] + list(range(12, 64))
    
    # For each order α, compute log of the moment
    rdp = []
    for alpha in orders:
        # Sampled Gaussian mechanism RDP
        rdp_alpha = _compute_rdp_sample_gaussian(
            q=sampling_rate, sigma=noise_multiplier, alpha=alpha
        )
        rdp.append(rdp_alpha * num_steps)  # composition
    
    # Convert to (ε,δ)-DP, optimizing over α
    epsilon = min(
        rdp_a + math.log(1/target_delta) / (alpha - 1) - math.log(alpha) / (alpha - 1)
        for rdp_a, alpha in zip(rdp, orders)
    )
    return epsilon

Privacy Amplification by Subsampling

When each round randomly subsamples clients with probability q:

If base mechanism is ε₀-RDP at order α:
Subsampled mechanism is approximately (q·ε₀)-RDP

This is why federated learning benefits from large client pools:
- 1000 clients, 10 selected per round → q = 0.01
- Privacy amplification factor: ~100x

See issue #773 for full specification.