The Relative Gaussian Mechanism and its Application to Private Gradient Descent

Yet, releasing R(x) might reveal sensitive information on x. Instead, the The Gaussian Mechanism (GM), which consists curator may use a private algorithm A to release a in adding Gaussian noise to a vectorvalued sanitized approximation A(R)(x) of R(x). To guarantee query before releasing it, is a standard that the amount of information leaked by releasing privacy protection mechanism. In particular, A(R)(x) is limited, DP ensures that the distributions given that the query respects some of A(R)(x) and A(R)(y) are close for any y x, i.e., L2 sensitivity property (the L2 distance between that is close to x according to a neighboring relation outputs on any two neighboring inputs (databases that only differ in one row for instance). Several is bounded), GM guarantees Rényi Differential divergences have been considered to measure the Privacy (RDP). Unfortunately, precisely closeness between these two distributions, leading to different bounding the L2 sensitivity can be hard, thus variants of DP. Among them, Rényi-Differential leading to loose privacy bounds. In this work, Privacy (RDP), which is based on the Rényi divergence, we consider a Relative L2 sensitivity assumption, has become popular for its mathematical properties in which the bound on the distance between [Mironov, 2017].