Hyperparameter Tuning with Renyi Differential Privacy

Nicolas PapernotThomas Steinke

article2022ICLR167 citationsOutstanding Paper Award

Establishes Rényi Differential Privacy bounds for hyperparameter search across multiple training runs, proving that cumulative privacy leakage remains modest when each candidate model is individually private.

Listen

Machine learning systems frequently retain sensitive training data, making differential privacy—a mathematical standard that prevents the leakage of individual records—critical for deployment in domains such as healthcare. Standard practice involves tuning hyperparameters (such as learning rates or regularization weights) across multiple training runs to optimize accuracy. However, practitioners often tune these configurations without privacy protections and only apply differential privacy to the final training run, assuming that hyperparameter settings reveal minimal information.

The article evaluates the privacy risks inherent in hyperparameter tuning and demonstrates how to rigorously preserve privacy across multiple training repetitions within the Rényi differential privacy framework.

To establish this, the article first demonstrates how non-private hyperparameter tuning leaks information using a synthetic classification experiment where outliers systematically distort optimal settings. It then develops a theoretical framework for private random hyperparameter search, where the number of training repetitions is randomized rather than fixed. The authors evaluate candidate probability distributions for these run counts—specifically truncated negative binomial, logarithmic, and Poisson distributions—and validate the approach through 500 trials fine-tuning a convolutional neural network on the benchmark MNIST dataset using differentially private stochastic gradient descent.

The investigation yields four key findings. First, tuning hyperparameters non-privately creates an exploitable channel for membership inference attacks, allowing adversaries to detect whether specific outlier records exist in the training set. Second, repeating a private base algorithm a fixed number of times causes privacy loss to accumulate linearly with the number of runs, offering no theoretical improvement over standard composition. Third, drawing the number of runs randomly reduces this privacy penalty dramatically, yielding bounds that grow logarithmically or remain independent of the repetition count. Fourth, the Poisson distribution delivers the superior privacy-utility balance in practical settings, avoiding the severe performance pitfalls of heavy-tailed distributions while maintaining tightly concentrated runtimes.

These findings demonstrate that organizations cannot treat hyperparameter selection as a separate, privacy-free step without undermining the compliance and confidentiality guarantees of the final model. Although private tuning increases the overall privacy parameter by a factor of roughly two to three relative to a single run, randomizing the repetition count prevents the severe linear degradation that would otherwise render extensive model search computationally or mathematically impermissible.

Organizations training machine learning models on sensitive data should integrate differential privacy into the hyperparameter tuning phase rather than applying it solely to final models. Teams should employ random search with Poisson-distributed run counts when operating under constrained privacy budgets. For broader reporting, practitioners should transparently disclose both the baseline privacy parameter of individual training runs and the cumulative privacy parameter of the overall hyperparameter search procedure.

The analysis carries several boundary conditions. The current framework applies strictly to non-adaptive hyperparameter selection (such as random search) and does not cover adaptive optimization techniques like Bayesian optimization. Additionally, empirical validation remains focused on synthetic data and benchmark image classification tasks. Confidence in the underlying theoretical guarantees remains exceptionally high, as the authors provide formal proofs showing that the derived privacy bounds are mathematically tight up to low-order terms.

Google differential privacies private information regularization parameters Rényi differential privacy private hyperparameter tuning privacy loss bounds

arXiv: 2110.03620

Paper: Deep Learning with Differential Privacy, Martín Abadi et al. (2016). It introduces the foundational DP-SGD framework and moment-accounting privacy analysis that the source uses as the baseline private training mechanism to be tuned.
Paper: Differentially Private Empirical Risk Minimization, Kamalika Chaudhuri et al. (2009). It formalizes differential privacy within empirical risk minimization and examines early procedures for private model and parameter selection.
Paper: On Over-fitting in Model Selection and Subsequent Selection Bias in Performance Evaluation, Gavin C. Cawley et al. (2010). It details how hyperparameter selection over finite validation sets leads to overfitting and information leakage during model selection.
Paper: Practical Bayesian Optimization of Machine Learning Algorithms, Jasper Snoek et al. (2012). It provides standard principles and algorithms for iterative hyperparameter tuning in machine learning models.
Paper: What Can We Learn Privately?, Shiva Prasad Kasiviswanathan et al. (2008). It establishes fundamental sample complexity and theoretical feasibility bounds for learning statistical models under differential privacy constraints.

No sufficiently relevant recommendations were found.

Cover for Hyperparameter Tuning with Renyi Differential Privacy

Abstract

For many differentially private algorithms, such as the prominent noisy stochastic gradient descent (DP-SGD), the analysis needed to bound the privacy leakage of a single training run is well understood. However, few studies have reasoned about the privacy leakage resulting from the multiple training runs needed to fine tune the value of the training algorithm's hyperparameters. In this work, we first illustrate how simply setting hyperparameters based on non-private training runs can leak private information. Motivated by this observation, we then provide privacy guarantees for hyperparameter search procedures within the framework of Renyi Differential Privacy. Our results improve and extend the work of Liu and Talwar (STOC 2019). Our analysis supports our previous observation that tuning hyperparameters does indeed leak private information, but we prove that, under certain assumptions, this leakage is modest, as long as each candidate training run needed to select hyperparameters is itself differentially private.

1 Introduction
1.1 Our Contributions
1.2 Background and Related Work
2 Motivation
3 Our Positive Results
3.1 Problem Formulation
3.2 Strawman approach: repeat the base algorithm a fixed number of times
3.3 Our algorithm for hyperparameter tuning
3.4 Main Results
3.5 Generic Rényi DP Bound for Any Distribution on the Number of Repetitions
3.6 Utility and Runtime of our Hyperparameter Tuning Algorithm
4 Conclusion
References
A Further Background
A.1 Differential Privacy & Rényi DP
A.2 Probability Generating Functions
A.2.1 Probability Generating Functions and Utility
B Proofs from Section
B.1 Proof of Generic Bound
B.2 Proofs of Distribution-specific Bounds
C Conditional Sampling Approach
D Negative Results on Improvements to our Analysis
D.1 Why a fixed number of repetitions does not result in good privacy.
D.2 Tight example for conditional sampling.
D.3 Tightness of our generic result.
D.4 Selection & Lower Bounds
E Extending our Results to Approximate DP
E.1 Truncating the Number of Repetitions

Knowls

Knowl 1 — Generic Rényi Divergence Bound for Selection over Randomized Repetitions
theoretical result
Let $\mathcal{Y}$ be a totally ordered set and fix $\lambda > 1$ . Let $K$ be a non-negative integer-valued random variable supported on $\mathbb{N} \cup \{0\}$ with probability generating function $f(x) := \mathbb{E}[x^K] = \sum_{k=0}^\infty \mathbb{P}[K = k] x^k$ defined for $x \in [0, 1]$ . Let $Q$ and $Q'$ be probability distributions over $\mathcal{Y}$ .

Define the randomized mechanism distribution $A$ on $\mathcal{Y}$ by drawing $K \sim f$ , then drawing $K$ independent samples from $Q$ , and outputting the maximum element according to the total order on $\mathcal{Y}$ (if $K = 0$ , outputting an arbitrary fixed element). Define $A'$ analogously by sampling $K \sim f$ and taking the maximum of $K$ independent samples from $Q'$ .

Then the Rényi divergence of order $\lambda$ between $A$ and $A'$ satisfies:

$D_\lambda(A \| A') \le D_\lambda(Q \| Q') + \frac{1}{\lambda - 1} \log \left( f'(q)^\lambda \cdot f'(q')^{1-\lambda} \right)$

where $f'(x) = \frac{d}{dx}f(x)$ , and $q, q' \in [0, 1]$ are obtained by applying the same measurable postprocessing function $g: \mathcal{Y} \to [0, 1]$ to $Q$ and $Q'$ respectively: $q = \mathbb{E}_{X \sim Q}[g(X)]$ and $q' = \mathbb{E}_{X' \sim Q'}[g(X')]$ .
Knowl 2 — Rényi Differential Privacy of Selection via Truncated Negative Binomial Repetitions
theoretical result
Let the truncated negative binomial distribution $D_{\eta, \gamma}$ with scale parameter $\gamma \in (0, 1)$ and shape parameter $\eta \in (-1, \infty)$ be supported on positive integers $\mathbb{N} = \{1, 2, \dots\}$ with probability mass function:

$\mathbb{P}[K = k] = \begin{cases} \frac{(1 - \gamma)^k}{\gamma^{-\eta} - 1} \prod_{\ell=0}^{k-1} \frac{\ell + \eta}{\ell + 1}, & \text{if } \eta \ne 0 \\[6pt] \frac{(1 - \gamma)^k}{k \log(1/\gamma)}, & \text{if } \eta = 0 \end{cases}$

with expected value $\mathbb{E}[K] = \frac{\eta (1 - \gamma)}{\gamma (1 - \gamma^\eta)}$ for $\eta \ne 0$ and $\mathbb{E}[K] = \frac{1/\gamma - 1}{\log(1/\gamma)}$ for $\eta = 0$ .

Let $Q: \mathcal{X}^n \to \mathcal{Y}$ be a randomized algorithm satisfying $(\lambda, \varepsilon)$ -Rényi Differential Privacy (RDP) and $(\hat{\lambda}, \hat{\varepsilon})$ -RDP for some $\varepsilon, \hat{\varepsilon} \ge 0$ , $\lambda \in (1, \infty)$ , and $\hat{\lambda} \in [1, \infty)$ , where $\mathcal{Y}$ is totally ordered.

Define algorithm $A: \mathcal{X}^n \to \mathcal{Y}$ which draws $K \sim D_{\eta, \gamma}$ , executes $Q(x)$ independently $K$ times, and returns the maximum outcome. Then $A$ satisfies $(\lambda, \varepsilon')$ -RDP with:

$\varepsilon' = \varepsilon + (1 + \eta)\left(1 - \frac{1}{\hat{\lambda}}\right)\hat{\varepsilon} + \frac{(1 + \eta) \log(1/\gamma)}{\hat{\lambda}} + \frac{\log \mathbb{E}[K]}{\lambda - 1}$

(When $\hat{\lambda} = 1$ , the term $(1 - 1/\hat{\lambda})\hat{\varepsilon}$ is defined to be $0$ ).
Knowl 3 — Rényi Differential Privacy of Selection via Poisson Repetitions
theoretical result
Let $\mathcal{Y}$ be a totally ordered output space. Let $Q: \mathcal{X}^n \to \mathcal{Y}$ be a randomized base algorithm satisfying $(\lambda, \varepsilon)$ -RDP and $(\hat{\varepsilon}, \hat{\delta})$ -differential privacy (DP) for some $\lambda \in (1, \infty)$ and $\varepsilon, \hat{\varepsilon}, \hat{\delta} \ge 0$ .

Let $\mu > 0$ . Define algorithm $A: \mathcal{X}^n \to \mathcal{Y}$ that samples $K \sim \text{Poisson}(\mu)$ (where $\mathbb{P}[K = k] = e^{-\mu} \frac{\mu^k}{k!}$ for $k \ge 0$ ), executes $Q(x)$ independently $K$ times, and returns the maximum outcome among the $K$ runs according to the total ordering on $\mathcal{Y}$ . If $K = 0$ , $A(x)$ returns a fixed default output independent of $x$ .

If the privacy parameters satisfy $e^{\hat{\varepsilon}} \le 1 + \frac{1}{\lambda - 1}$ , then $A$ satisfies $(\lambda, \varepsilon')$ -RDP where:

$\varepsilon' = \varepsilon + \mu \cdot \hat{\delta} + \frac{\log \mu}{\lambda - 1}$
Knowl 4 — Pure and Concentrated Differential Privacy Guarantees for Truncated Negative Binomial Selection
theoretical result
Let $Q: \mathcal{X}^n \to \mathcal{Y}$ be a randomized algorithm whose output range $\mathcal{Y}$ is totally ordered. Let $A: \mathcal{X}^n \to \mathcal{Y}$ be the algorithm that draws $K \sim D_{\eta, \gamma}$ from the truncated negative binomial distribution with $\gamma \in (0, 1)$ and $\eta \in (-1, \infty)$ , executes $Q(x)$ independently $K$ times, and returns the maximal output.
1. Pure Differential Privacy: If $Q$ satisfies $(\varepsilon, 0)$ -DP, then $A$ satisfies $((2 + \eta)\varepsilon, 0)$ -DP. In particular, for the logarithmic distribution ( $\eta = 0$ ), $A$ achieves $(2\varepsilon, 0)$ -DP, improving over the $(3\varepsilon, 0)$ -DP bound for geometric repetitions ( $\eta = 1$ ).
2. Concentrated Differential Privacy (zCDP): If $Q$ satisfies $\rho$ -zCDP (meaning $Q$ is $(\lambda, \rho \cdot \lambda)$ -RDP for all $\lambda > 1$ ) with $\rho \le \log(1/\gamma)$ , then $A$ satisfies $(\lambda, \varepsilon')$ -RDP for all $\lambda > 1$ with:
$\varepsilon' = \begin{cases} 2\sqrt{\rho \log \mathbb{E}[K]} + 2(1 + \eta)\sqrt{\rho \log(1/\gamma)} - \eta\rho, & \text{if } \lambda \le 1 + \sqrt{\frac{\log \mathbb{E}[K]}{\rho}} \\[6pt] \rho(\lambda - 1) + \frac{\log \mathbb{E}[K]}{\lambda - 1} + 2(1 + \eta)\sqrt{\rho \log(1/\gamma)} - \eta\rho, & \text{if } \lambda > 1 + \sqrt{\frac{\log \mathbb{E}[K]}{\rho}} \end{cases}$
Knowl 5 — Black-Box Differentially Private Hyperparameter Tuning via Randomized Repetitions
algorithm
The algorithm conducts hyperparameter search over $m$ candidate configurations by running randomized base algorithms a random number of times $K$ drawn from a predefined distribution, then outputting the candidate model with the highest quality score.
Input: Dataset $x \in \mathcal{X}^n$ , set of $m$ base learning algorithms $\{M_1, \dots, M_m\}$ , distribution $\mathcal{D}$ over repetition counts $\mathbb{N} \cup \{0\}$ , quality ordering on output space $\mathcal{Y}$
Output: Best model-hyperparameter pair $y \in \mathcal{Y}$
Sample $K \sim \mathcal{D}$
if $K = 0$ then
    return default outcome $y_0 \in \mathcal{Y}$
end if
for $k = 1, 2, \dots, K$ do
    Sample index $j_k \in \{1, \dots, m\}$ uniformly at random
    Run candidate algorithm $Y_k \leftarrow M_{j_k}(x)$
end for
return $\max_{\mathcal{Y}} \{Y_1, Y_2, \dots, Y_K\}$
The range $\mathcal{Y}$ consists of pairs containing the trained model parameters and hyperparameter identifier $j$ , along with an evaluation metric (e.g., validation accuracy on a disjoint split) that establishes a total order. The distribution $\mathcal{D}$ is chosen to be a truncated negative binomial $D_{\eta, \gamma}$ (such as logarithmic $\eta = 0$ ) or a Poisson distribution $\text{Poisson}(\mu)$ to avoid linear composition privacy leakage.
Knowl 6 — Linear Privacy Loss Degradation for Deterministic Repetition Counts
theoretical result
Repeating a base DP mechanism a fixed, deterministic number of times $k$ and returning the best result causes the privacy loss to grow linearly in $k$ .

For every $\varepsilon > 0$ , there exists an $(\varepsilon, 0)$ -DP algorithm $Q: \mathcal{X}^n \to \{1, 2\}$ such that running $Q$ a fixed $k$ times and returning the best outcome (under total order $1 > 2$ ) yields an algorithm $A$ satisfying:
1. $A$ is not $\hat{\varepsilon}$ -DP for any $\hat{\varepsilon} < k\varepsilon$ .
2. For every $\lambda > 1$ , $A$ is not $(\lambda, \hat{\varepsilon}(\lambda))$ -RDP for any $\hat{\varepsilon}(\lambda) < \varepsilon'(k, \lambda)$ , where:
$\varepsilon'(k, \lambda) = k\varepsilon - \frac{k \log(1 + e^{-\varepsilon})}{\lambda - 1}$

For orders $\lambda \ge 1 + 1/\varepsilon$ , this lower bound implies $\varepsilon'(k, \lambda) = \Omega(k\varepsilon)$ , confirming that deterministic repetition inherently incurs a linear privacy degradation.
Knowl 7 — Expected Quantile Utility and Success Probability under Randomized Repetitions
equation
Let $K$ be a non-negative random variable representing the number of repetitions, with probability generating function $f(x) := \mathbb{E}[x^K]$ .
1. Expected Quantile of the Best Candidate: If the utility quantile of a single run of the base algorithm is uniformly distributed on $[0, 1]$ , the expected quantile of the best outcome after $K$ repetitions is:
$\mathbb{E}\left[ \frac{K}{K + 1} \right] = \mathbb{E}\left[ 1 - \frac{1}{K + 1} \right] = \int_0^1 x \cdot f'(x) \, dx = 1 - \int_0^1 f(x) \, dx$
1. Success Probability Amplification: If each invocation of the base algorithm has an independent probability $1/m$ of yielding an acceptable outcome, the probability $\beta$ that the best of $K$ runs produces an acceptable outcome is:
$\beta = 1 - \mathbb{E}\left[ (1 - 1/m)^K \right] = 1 - f(1 - 1/m)$
Knowl 8 — Rényi Differential Privacy Guarantees for Conditional Threshold Sampling
theoretical result
Let $\lambda \in (1, \infty)$ and let $Q, Q'$ be probability distributions on $\Omega$ with $D_\lambda(Q \| Q') < \infty$ . Let $S \subset \Omega$ be an acceptance event with non-zero measure under $Q$ and $Q'$ . Let $Q_S$ and $Q'_S$ denote the conditional distributions $Q|_S$ and $Q'|_S$ .

For all $p, q, r \in [1, \infty]$ satisfying $1/p + 1/q + 1/r = 1$ , the Rényi divergence satisfies:

$D_\lambda(Q_S \| Q'_S) \le \frac{\lambda - 1/p - 1/r}{\lambda - 1} D_{r(\lambda - 1/p)}(Q \| Q') + \frac{\lambda + 1/q - 2}{\lambda - 1} D_{\lambda + 1/q - 1}(Q' \| Q) + \frac{1/r + 1}{\lambda - 1} \log \left(\frac{1}{Q(S)}\right)$

Specialized corollaries include:

$D_\infty(Q_S \| Q'_S) \le D_\infty(Q \| Q') + D_\infty(Q' \| Q)$

$D_\lambda(Q_S \| Q'_S) \le D_\lambda(Q \| Q') + \frac{\lambda - 2}{\lambda - 1} D_{\lambda - 1}(Q' \| Q) + \frac{2}{\lambda - 1} \log \left(\frac{1}{Q(S)}\right)$
Knowl 9 — Extension of Randomized Repetition Privacy Guarantees to Approximate Differential Privacy
theoretical result
Let $\mathcal{Y}$ be totally ordered. Let $Q, Q'$ be distributions on $\mathcal{Y}$ decomposed as convex combinations $Q = (1 - \delta_0) Q_{1-\delta_0} + \delta_0 Q_{\delta_0}$ and $Q' = (1 - \delta_0) Q'_{1-\delta_0} + \delta_0 Q'_{\delta_0}$ . Let $K \sim f(x) = \mathbb{E}[x^K]$ , and let $K'$ be a random variable on $\mathbb{N} \cup \{0\}$ with distribution $\mathbb{P}[K' = k] = \mathbb{P}[K = k](1 - \delta_0)^k / f(1 - \delta_0)$ .

For algorithm $A_Q^K$ outputting the maximum of $K$ samples from $Q$ , the approximate Rényi divergence satisfies:

$D_\lambda^\delta(A_Q^K \| A_{Q'}^K) \le D_\lambda(A_{Q_{1-\delta_0}}^{K'} \| A_{Q'_{1-\delta_0}}^{K'}), \quad \text{where } \delta = 1 - f(1 - \delta_0)$

Corollary for Poisson Repetitions: If $Q$ satisfies $(\varepsilon_0, \delta_0)$ -DP and $K \sim \text{Poisson}(\mu)$ , then for all $\lambda \le 1 + \frac{1}{e^{\varepsilon_0} - 1}$ , the algorithm $A$ satisfies $\delta'$ -approximate $(\lambda, \varepsilon')$ -RDP with:

$\varepsilon' = \varepsilon_0 + (e^{\varepsilon_0} - 1) \log \mu, \qquad \delta' = 1 - e^{-\mu \delta_0} \le \mu \cdot \delta_0$
Knowl 10 — Rényi Differential Privacy Bound for Repetitions with a Hard Upper Bound
theoretical result
Let $\lambda > 1$ , $m \in \mathbb{N}$ , and let $K$ be a non-negative integer-valued random variable with probability generating function $f(x) = \sum_{k=0}^\infty \mathbb{P}[K = k] x^k$ . Let $\tilde{K}$ be $K$ conditioned on $K \le m$ , i.e., $\mathbb{P}[\tilde{K} = k] = \mathbb{P}[K = k \mid K \le m]$ .

Let $Q, Q'$ be probability distributions over a totally ordered space $\mathcal{Y}$ . Let $A$ and $A'$ denote the distributions obtained by sampling $\tilde{K}$ , drawing $\tilde{K}$ independent samples from $Q$ and $Q'$ respectively, and outputting their maximum. Then:

$D_\lambda(A \| A') \le D_\lambda(Q \| Q') + \frac{1}{\lambda - 1} \log \left( f'(q)^\lambda f'(q')^{1-\lambda} \right) + \frac{\log\left(\frac{1}{1 - \mathbb{P}[K > m]}\right)}{\lambda - 1} + \log\left( 1 + \frac{\mathbb{E}[K \cdot \mathbb{I}[K > m]]}{\mathbb{E}[K] - \mathbb{E}[K \cdot \mathbb{I}[K > m]]} \right)$

where $q, q' \in [0, 1]$ are obtained by postprocessing $Q$ and $Q'$ with the same function $g: \mathcal{Y} \to [0, 1]$ .
Knowl 11 — Membership Inference Vulnerability in Non-Private Hyperparameter Tuning
empirical result
Tuning hyperparameters without differential privacy creates an information channel that leaks the presence of individual training points.

In a soft-margin support vector machine (SVM) trained with SGD minimizing the loss $l_{w, b}(x, y) = \|w\|_2^2 + \alpha \max\{0, 1 - y(w \cdot x + b)\}$ on a dataset $D$ consisting of 40 samples from two 2D Gaussians with standard deviation 1.0 centered at $\mu_{-1} = (7.86, -3.36)$ and $\mu_1 = (6.42, -9.17)$ :
1. Without outliers, training accuracy decreases monotonically as the regularization weight hyperparameter $\alpha$ increases.
2. When 8 outlier points $x_0 = (7.9, -8.0)$ are added to the negative class in $D'$ , the accuracy curve exhibits a prominent turning point with optimal performance peaking around $\alpha = 8$ .
An adversary observing the selected hyperparameter $\alpha$ can distinguish whether the outlier records were present in the training set, demonstrating that non-private hyperparameter tuning is vulnerable to membership inference.

Coverage note — None was omitted; all primary theoretical results (generic RDP bounds, negative binomial, Poisson, conditional threshold sampling, approximate DP extensions, hard truncation bounds, and deterministic repetition lower bounds), utility derivations, and empirical demonstrations have been captured.

References

1.Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308–318, 2016.
2.Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. arXiv preprint arXiv:1807.01647, 2018.
3.Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, pp. 464–473. IEEE, 2014.
4.Raef Bassily, Kobbi Nissim, Adam Smith, Thomas Steinke, Uri Stemmer, and Jonathan Ullman. Algorithmic stability for adaptive data analysis. SIAM Journal on Computing, (0):STOC16–377, 2021.
5.James Bergstra and Yoshua Bengio. Random search for hyper-parameter optimization. Journal of machine learning research, 13(2), 2012.
6.Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of Cryptography Conference, pp. 635–658. Springer, 2016.
7.Mark Bun, Jonathan Ullman, and Salil Vadhan. Fingerprinting codes and the price of approximate differential privacy. In Proceedings of the forty-sixth annual ACM symposium on Theory of computing, pp. 1–10, 2014.
8.Mark Bun, Cynthia Dwork, Guy N Rothblum, and Thomas Steinke. Composable and versatile privacy via truncated cdp. In Proceedings of the 50th Annual ACM SIGACT Symposium on Theory of Computing, pp. 74–86, 2018.
9.Clément L Canonne, Gautam Kamath, and Thomas Steinke. The discrete gaussian for differential privacy. arXiv preprint arXiv:2004.00010, 2020.
10.Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. arXiv preprint arXiv:2012.07805, 2020.
11.Kamalika Chaudhuri and Staal A Vinterbo. A stability-based validation procedure for differentially private machine learning. In C. J. C. Burges, L. Bottou, M. Welling, Z. Ghahramani, and K. Q. Weinberger (eds.), Advances in Neural Information Processing Systems, volume 26. Curran Associates, Inc., 2013. URL https://proceedings.neurips.cc/paper/2013/file/e6d8545daa42d5ced125a4bf747b3688-Paper.pdf.
12.Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4):211–407, 2014.
13.Cynthia Dwork and Guy N Rothblum. Concentrated differential privacy. arXiv preprint arXiv:1603.01887, 2016.
14.Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 486–503. Springer, 2006a.
15.Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. 265–284. Springer, 2006b.
16.Cynthia Dwork, Moni Naor, Omer Reingold, Guy N Rothblum, and Salil Vadhan. On the complexity of differentially private data release: efficient algorithms and hardness results. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pp. 381–390, 2009.
17.Cynthia Dwork, Guy N Rothblum, and Salil Vadhan. Boosting and differential privacy. In 2010 IEEE 51st Annual Symposium on Foundations of Computer Science, pp. 51–60. IEEE, 2010.
18.Konstantina Kourou, Themis P Exarchos, Konstantinos P Exarchos, Michalis V Karamouzis, and Dimitrios I Fotiadis. Machine learning applications in cancer prognosis and prediction. Computational and structural biotechnology journal, 13:8–17, 2015.
19.Jingcheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, pp. 298–309, 2019. URL https://arxiv.org/abs/1811.07971.
20.Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS’07), pp. 94–103. IEEE, 2007.
21.Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pp. 263–275. IEEE, 2017.
22.Ilya Mironov, Kunal Talwar, and Li Zhang. R'enyi differential privacy of the sampled gaussian mechanism. arXiv preprint arXiv:1908.10530, 2019.
23.Shubhankar Mohapatra, Sajin Sasy, Xi He, Gautam Kamath, and Om Thakkar. The role of adaptive optimizers for honest private hyperparameter selection. arXiv preprint arXiv:2111.04906, 2021.
24.Nicolas Papernot, Abhradeep Thakurta, Shuang Song, Steve Chien, and Úlfar Erlingsson. Tempered sigmoid activations for deep learning with differential privacy. arXiv preprint arXiv:2007.14191, 2020.
25.Ryan Rogers and Thomas Steinke. A better privacy analysis of the exponential mechanism. DifferentialPrivacy.org, 07 2021. https://differentialprivacy.org/exponential-mechanism-bounded-range/.
26.Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 3–18. IEEE, 2017.
27.Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference on Signal and Information Processing, pp. 245–248. IEEE, 2013.
28.Thomas Steinke and Jonathan Ullman. Tight lower bounds for differentially private selection. In 2017 IEEE 58th Annual Symposium on Foundations of Computer Science (FOCS), pp. 552–563. IEEE, 2017.
29.Tim Van Erven and Peter Harremos. Rényi divergence and kullback-leibler divergence. IEEE Transactions on Information Theory, 60(7):3797–3820, 2014.
30.Jenna Wiens, Suchi Saria, Mark Sendak, Marzyeh Ghassemi, Vincent X Liu, Finale Doshi-Velez, Kenneth Jung, Katherine Heller, David Kale, Mohammed Saeed, Pilar N. Ossorio, Sonoo Thadaney-Israni, and Anna Goldenberg. Do no harm: a roadmap for responsible machine learning for health care. Nature medicine, 25(9):1337–1340, 2019.
31.Yuqing Zhu and Yu-Xiang Wang. Improving sparse vector technique with renyi differential privacy. In Advances in Neural Information Processing Systems 33 pre-proceedings (NeurIPS 2020), 2020. URL https://papers.nips.cc/paper/2020/hash/e9bf14a419d77534105016f5ec122d62-Abstract.html.

Citation

MLA

Papernot, N., and T. Steinke. “Hyperparameter Tuning with Renyi Differential Privacy”. arXiv, 2021, http://arxiv.org/abs/2110.03620v2.

APA

Papernot, N., & Steinke, T. (2021). Hyperparameter Tuning with Renyi Differential Privacy. arXiv. http://arxiv.org/abs/2110.03620v2

Chicago

Papernot, N., and T. Steinke. 2021. “Hyperparameter Tuning with Renyi Differential Privacy”. arXiv. http://arxiv.org/abs/2110.03620v2.

Harvard

Papernot, N. and Steinke, T. (2021) “Hyperparameter Tuning with Renyi Differential Privacy”, arXiv [Preprint]. Available at: http://arxiv.org/abs/2110.03620v2.

Vancouver

1. Papernot N, Steinke T (2021) Hyperparameter Tuning with Renyi Differential Privacy. arXiv

BibTeX

@article{papernot2021hyperparameter,
  title = {Hyperparameter Tuning with Renyi Differential Privacy},
  author = {Papernot, Nicolas and Steinke, Thomas},
  year = {2021},
  journal = {arXiv},
  url = {http://arxiv.org/abs/2110.03620v2},
  eprint = {2110.03620}
}

Metadata:arXiv

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

License: Published with permission

Hyperparameter Tuning with Renyi Differential Privacy

Abstract

Topics

Keywords

Table of Contents

Knowls

Knowl 1 — Generic Rényi Divergence Bound for Selection over Randomized Repetitions

Knowl 2 — Rényi Differential Privacy of Selection via Truncated Negative Binomial Repetitions

Knowl 3 — Rényi Differential Privacy of Selection via Poisson Repetitions

Knowl 4 — Pure and Concentrated Differential Privacy Guarantees for Truncated Negative Binomial Selection

Knowl 5 — Black-Box Differentially Private Hyperparameter Tuning via Randomized Repetitions

Knowl 6 — Linear Privacy Loss Degradation for Deterministic Repetition Counts

Knowl 7 — Expected Quantile Utility and Success Probability under Randomized Repetitions

Knowl 8 — Rényi Differential Privacy Guarantees for Conditional Threshold Sampling

Knowl 9 — Extension of Randomized Repetition Privacy Guarantees to Approximate Differential Privacy

Knowl 10 — Rényi Differential Privacy Bound for Repetitions with a Hard Upper Bound

Knowl 11 — Membership Inference Vulnerability in Non-Private Hyperparameter Tuning

References

Citation

BibTeX

Access the Paper