Comparing privacy notions for protection against reconstruction attacks in machine learning

TL;DR

This work tackles reconstruction attacks in machine learning and federated learning by addressing the difficulty of comparing diverse privacy notions (e.g., DP and metric privacy) that use different privacy parameters. It introduces a dual framework: (i) using Rényi differential privacy (RDP) as a unifying bridge to compare Gaussian (DP) and von Mises-Fisher (VMF, metric privacy) mechanisms, and (ii) deploying Bayes' capacity to quantify reconstruction-threat leakage beyond what $(\epsilon,\delta)$ can capture. The authors derive RDP bounds for VMF, outline two DP accounting approaches, and provide continuous Bayes' capacity formulas for Gaussian and VMF noise, enabling direct mechanism comparison under reconstruction threats. Experimental results on MNIST and Fashion-MNIST with a small MLP show Gaussian noise offers better utility at similar privacy budgets, while VMF noise provides stronger protection against gradient-based reconstruction attacks; Bayes' capacity aligns more consistently with reconstruction risk than DP budgets. Overall, the paper provides a principled, cross-definition framework for privacy-utilityTradeoffs in ML/FL and demonstrates Bayes' capacity as a robust reconstruction-threat metric.

Abstract

Within the machine learning community, reconstruction attacks are a principal concern and have been identified even in federated learning (FL), which was designed with privacy preservation in mind. In response to these threats, the privacy community recommends the use of differential privacy (DP) in the stochastic gradient descent algorithm, termed DP-SGD. However, the proliferation of variants of DP in recent years\textemdash such as metric privacy\textemdash has made it challenging to conduct a fair comparison between different mechanisms due to the different meanings of the privacy parameters $ε$ and $δ$ across different variants. Thus, interpreting the practical implications of $ε$ and $δ$ in the FL context and amongst variants of DP remains ambiguous. In this paper, we lay a foundational framework for comparing mechanisms with differing notions of privacy guarantees, namely $(ε,δ)$-DP and metric privacy. We provide two foundational means of comparison: firstly, via the well-established $(ε,δ)$-DP guarantees, made possible through the Rényi differential privacy framework; and secondly, via Bayes' capacity, which we identify as an appropriate measure for reconstruction threats.

Figures (6)

• Figure 1: Reconstruction results, in terms of SSIM or MSE, across the datasets under different privacy settings by the Inverting Gradients Attack (IGA).
• Figure 2: Utility results, in terms of accuracy, across the datasets under different privacy settings.
• Figure 3: Reconstruction images for both datasets by the Inverting Gradients Attack (IGA).
• Figure 4: Bayes' capacity is a better predictor for MSE than is $\epsilon$. In both datasets, the same $\epsilon$ values give different MSEs but similar Bayes' capacities give similar MSEs.
• Figure 5: Comparing leakage measures: $\epsilon$ vs Bayes' capacity for Gaussian and VMF mechanisms.

Theorems & Definitions (21)

• Definition 1: Differential privacy dwork-roth:2014Dwork-etal:2006:DP
• Definition 2: Metric privacy chatzikokolakis-etal:2013:PETS
• Definition 3: Gaussian mechanism
• Definition 4: VMF mechanism
• Definition 5: Rényi differential privacy mironov:2017:CSF
• Proposition 1
• Theorem 1
• Proposition 2
• Proposition 3
• Proposition 4: Canonne_Kamath_Steinke_2022