Results 971 - 980 of 24443

While differential privacy is the gold standard in centralized privacy-preserving machine learning, it is not well suited to decentralized learning where participants collaboratively train a model via peer-to-peer messages. We present a relaxation of differential privacy that captures a relevant trust setting for decentralized learning and show how decentralization can lead to privacy amplification mechanisms. We illustrate these findings on graphs from the Fediverse (alternative social media networks).

In response to calls for open data and growing privacy threats, organizations are increasingly adopting privacy-preserving techniques such as differential privacy (DP) that inject statistical noise when generating published datasets. These techniques are designed to protect privacy of data subjects while enabling useful analyses, but their reception by data users is under-explored. We developed documentation that presents the noise characteristics of two Wikipedia pageview datasets: one using rounding (heuristic privacy) and another using DP (formal privacy). After incorporating expert feedback (n=5), we used these documents to conduct a task-based contextual inquiry (n=15) exploring how data users--largely unfamiliar with these methods--perceive, interact with, and interpret privacy-preserving noise during data analysis. Based on our findings, we offer design recommendations for documentation and tools to better support data users working with privacy-noised data. Based on joint work with Harold Triedman, Priyanka Nanayakkara, Rachel Cummings, Gabriel Kaptchuk, Sean Kross, and Elissa Redmiles.

Standard techniques for differentially private estimation, such as Laplace or Gaussian noise addition, require guaranteed bounds on the sensitivity of the estimator in question. But such sensitivity bounds are often large or simply unknown. Thus we seek differentially private methods that can be applied to arbitrary black-box functions. A handful of such techniques exist, but all are either inefficient in their use of data or require evaluating the function on exponentially many inputs. In this work we present a scheme that trades off between statistical efficiency (i.e., how much data is needed) and oracle efficiency (i.e., the number of evaluations). We also present lower bounds showing the near-optimality of our scheme.

In this talk, we will discuss recent works that establish deep connections between private continual counting and a concept in matrix analysis (factorization norms) with its applications in private training. We then discuss the series of recent results that improve upon more than three decades-old results in matrix analysis. In particular, we will show an upper and lower bound on its norm with an additive gap of $0.14 + o(1)$. Moreover, the upper bound is achieved by an explicit factorization. Based on joint works with Hendrik Fichtenberger (Google), Monika Henzinger (ISTA), Nikita Kalinin (ISTA), and Sarvagya Upadhyay (Fujitsu Research Labs) and a topic of recent monologue (https://arxiv.org/abs/2506.08201)

This talk studies privacy-preserving learning when heterogeneity is part of the problem's structure. I will begin with recent work on private personalized learning, which develops a taxonomy of privacy notions for multitask learning and meta-learning, and proves separations between them. These results show that modeling privacy can fundamentally change what we can and cannot do in learning. I will then briefly discuss other forms of heterogeneity that fit within this perspective, particularly settings where privacy requirements differ across the data. This includes feature-specific privacy and heterogeneous local differential privacy, where privacy guarantees vary across coordinates or users. Taken together, these works suggest a broader message: meaningful privacy guarantees must adapt to the heterogeneous structure of modern learning problems. 

We consider the privacy amplification properties of a sampling scheme in which a user’s data is used in k steps chosen randomly and uniformly from a sequence (or set) of t steps. This sampling scheme has been recently applied in the context of differentially private optimization (Chua et al., 2024a; Choquette-Choo et al., 2025) and communication-efficient high-dimensional private aggregation (Asi et al., 2025), where it was shown to have utility advantages over the standard Poisson sampling. Theoretical analyses of this sampling scheme (Feldman & Shenfeld, 2025; Dong et al.,2025) lead to bounds that are close to those of Poisson sampling, yet still have two significant shortcomings. In this work, we demonstrate that the privacy loss distribution (PLD) of random allocation applied to any differentially private algorithm can be computed efficiently. When applied to the Gaussian mechanism, our results demonstrate that random allocation can be used in place of Poisson subsampling with no degradation in resulting privacy guarantees. In addition, our work develops tools for privacy accounting based on approximate stochastic domination of the privacy loss random variable. In particular, we demonstrate how to correctly perform subsampling directly on PLD bounds, enabling accurate privacy accounting for more general algorithms.

Privacy amplification by sampling reduces the noise necessary to achieve a target privacy guarantee when training a model with differential private stochastic gradient descent (DP-SGD), by compounding the randomness in forming batches with the randomness in noise addition in DP-SGD. Historically, the literature on DP-SGD has assumed batches are formed using Poisson sampling, but in practice shuffling-like methods were used, and thus the gains from privacy amplification achieved in the literature could not be achieved in practice. Recently, infrastructure has caught up and privacy amplification by sampling is now feasible in practice, but with a set of restrictions introducing new technical challenges. This talk will cover recent work on these challenges, including (i) handling a need for fixed-size batches due to JIT compilation, (ii) privacy amplification for correlated noise mechanisms, and (iii) privacy guarantees that are robust to side channel information.