search

yuxiangw / autodp

autodp: A flexible and easy-to-use package for differential privacy
Apache License 2.0
260 stars 52 forks source link

difference between eps using this method and abadi #3

Open srxzr opened 4 years ago

srxzr commented 4 years ago

Using the implementation of Abadi et al computes smaller eps compare to this method. I would appreciate your opinion about it. Is their method tighter ?

https://github.com/tensorflow/privacy/tree/master/tutorials

BorjaBalle commented 4 years ago

Hi Milad, Thanks for your comment. Could you provide a bit more context in the form of a minimally working example?

yuxiangw commented 4 years ago

Short answers: AutoDP allows privacy amplification by choosing a random subset. Both autodp and tf.privacy have implemented the version for poisson sampling (including each data point with a fixed probability iid). For poisson sampling, the state-of-the-art calculation (at least for Gaussian mechanism) is a bit tighter than the "random subset" calculation. Hope that explains.

yuxiangw commented 4 years ago

The bottomline is that:
If your algorithm is actually doing a random subset with a fixed cardinality, then using the Poisson sampling bounds to account for privacy would be the incorrect thing to do. You should make sure that your algorithm and how you track your privacy losses is consistent.