A direct formula makes private-training noise calibration less conservative

Choosing a noise level for private training often means repeatedly running an accountant until it finds a value that meets a target. Can a direct calculation provide a valid membership-test bound while requiring less noise than a simpler formula? The paper studies that question for DP-SGD with random allocation.

They reduce random-allocation training to a Gaussian pair, then derive a direct membership-test bound and an exact noise calculation.

The authors analyze DP-SGD with random allocation, where each record is assigned independently to one of M steps in every epoch.

They reduce the released model’s membership-inference risk to the distance between two Gaussian distributions and derive both a closed-form upper bound and an exact calculation for that pair.

In nine one-epoch target settings, the formula required 7.4% to 16.7% more noise than exact calibration. In four tested models, exact-noise training also produced higher mean test or validation accuracy.

The findings support the exact calculation as a way to meet the stated target with less noise in these settings.

The guarantee concerns membership tests for one added or removed record and does not give the full privacy profile. Total variation alone also cannot establish an (epsilon, delta) guarantee with delta below the stated bound, and can be loose for tests with small false-positive rates.