Thompson Sampling Itself is Differentially Private
Tingting Ou, Marco Avella Medina, Rachel Cummings
TL;DR
This paper proves that Thompson Sampling with Gaussian priors is differentially private in its vanilla form, using Gaussian differential privacy (GDP) to obtain per-round privacy and composition across $T$ rounds, and showing that standard regret bounds still hold. It further introduces two lightweight modifications—pre-pulling each arm $b$ times and scaling the sampling variance by $c$—to achieve a tunable privacy-regret trade-off, with explicit GDP and regret guarantees that depend on $b$ and $c$. The authors provide a unified regret analysis for the modified algorithm and demonstrate, via experiments with Bernoulli and truncated exponential rewards, that intermediate values of $b$ and $c$ yield the best privacy-accuracy balance under a fixed privacy budget. Overall, the work shows that privacy can be achieved in bandit learning without sacrificing baseline performance and offers a practical means to trade privacy for tighter guarantees when needed.
Abstract
In this work we first show that the classical Thompson sampling algorithm for multi-arm bandits is differentially private as-is, without any modification. We provide per-round privacy guarantees as a function of problem parameters and show composition over $T$ rounds; since the algorithm is unchanged, existing $O(\sqrt{NT\log N})$ regret bounds still hold and there is no loss in performance due to privacy. We then show that simple modifications -- such as pre-pulling all arms a fixed number of times, increasing the sampling variance -- can provide tighter privacy guarantees. We again provide privacy guarantees that now depend on the new parameters introduced in the modification, which allows the analyst to tune the privacy guarantee as desired. We also provide a novel regret analysis for this new algorithm, and show how the new parameters also impact expected regret. Finally, we empirically validate and illustrate our theoretical findings in two parameter regimes and demonstrate that tuning the new parameters substantially improve the privacy-regret tradeoff.