Amplified Patch-Level Differential Privacy for Free via Random Cropping

Abstract

Random cropping is one of the most common data augmentation techniques in computer vision, yet the role of its inherent randomness in training differentially private machine learning models has thus far gone unexplored. We observe that when sensitive content in an image is spatially localized, such as a face or license plate, random cropping can probabilistically exclude that content from the model's input. This introduces a third source of stochasticity in differentially private training with stochastic gradient descent, in addition to gradient noise and minibatch sampling. This additional randomness amplifies differential privacy without requiring changes to model architecture or training procedure. We formalize this effect by introducing a patch-level neighboring relation for vision data and deriving tight privacy bounds for differentially private stochastic gradient descent (DP-SGD) when combined with random cropping. Our analysis quantifies the patch inclusion probability and shows how it composes with minibatch sampling to yield a lower effective sampling rate. Empirically, we validate that patch-level amplification improves the privacy-utility trade-off across multiple segmentation architectures and datasets. Our results demonstrate that aligning privacy accounting with domain structure and additional existing sources of randomness can yield stronger guarantees at no additional cost.

Figures (31)

• Figure 1: Illustration of the effect of random cropping on a private patch as the license plate (in red). Left: Original image with a designated private patch. Middle: A random crop that excludes the private patch. Right: A random crop that includes a part of the private patch. Any intersection allows the private patch to influence the output of the model.
• Figure 2: Privacy profiles for different mechanisms. DP-SGD with patch-level subsampling (blue) achieves stronger privacy amplification compared to standard minibatch subsampling (orange) with identical $\sigma=1$. Even with an an extremely large noise scale $\sigma_{\text{data}}=1000$, data-level noise addition (green) is less private.
• Figure 3: Varying crop size for patch-level subsampling, for different noise levels and $\delta = 10^{-5}$. The privacy parameter $\varepsilon$ increases rapidly with the crop size. All curves saturate at the minibatch subsampling baseline once the intersection probability becomes $1$.
• Figure 4: Varying private patch size for patch-level subsampling, for different noise levels and $\delta = 10^{-5}$. The privacy parameter $\varepsilon$ increases approximately linearly with the size of the private patch. All curves saturate at the minibatch-only baseline once the intersection probability becomes $1$.
• Figure 5: Model performance versus privacy-level $\varepsilon$ for DP-SGD with patch-level sampling (blue) and minibatch subsampling (orange). Results are averaged over four seeds; error bars show standard deviation. For Cityscapes, we use $\delta = 1/2975$, and for A2D2, $\delta = 1/18557$, following $\delta = 1/\texttt{epoch\_size}$. For both datasets a private patch size of $10 \times 10$ is assumed. DG-SGD with patch-level privacy overperforms significantly, given the exact same setup.

Theorems & Definitions (23)

• Definition 1
• Proposition 1
• Proposition 2
• Proposition 3
• Definition 2
• Proposition 4
• Proposition 5
• Definition 3
• Definition 4
• Definition 5