{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,10]],"date-time":"2026-10-10T05:44:54Z","timestamp":1791611094183,"version":"4.3.4"},"reference-count":41,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2023,2,24]],"date-time":"2023-02-24T00:00:00Z","timestamp":1677196800000},"content-version":"vor","delay-in-days":388,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CAREER DMS-1847415"],"award-info":[{"award-number":["CAREER DMS-1847415"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CCF-1763314"],"award-info":[{"award-number":["CCF-1763314"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CNS-1253345"],"award-info":[{"award-number":["CNS-1253345"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,2,1]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>In the past decade, differential privacy has seen remarkable success as a rigorous and practical formalization of data privacy. This privacy definition and its divergence based relaxations, however, have several acknowledged weaknesses, either in handling composition of private algorithms or in analysing important primitives like privacy amplification by subsampling. Inspired by the hypothesis testing formulation of privacy, this paper proposes a new relaxation of differential privacy, which we term \u2018f-differential privacy\u2019 (f-DP). This notion of privacy has a number of appealing properties and, in particular, avoids difficulties associated with divergence based relaxations. First, f-DP faithfully preserves the hypothesis testing interpretation of differential privacy, thereby making the privacy guarantees easily interpretable. In addition, f-DP allows for lossless reasoning about composition in an algebraic fashion. Moreover, we provide a powerful technique to import existing results proven for the original differential privacy definition to f-DP and, as an application of this technique, obtain a simple and easy-to-interpret theorem of privacy amplification by subsampling for f-DP. In addition to the above findings, we introduce a canonical single-parameter family of privacy notions within the f-DP class that is referred to as \u2018Gaussian differential privacy\u2019 (GDP), defined based on hypothesis testing of two shifted Gaussian distributions. GDP is the focal privacy definition among the family of f-DP guarantees due to a central limit theorem for differential privacy that we prove. More precisely, the privacy guarantees of any hypothesis testing based definition of privacy (including the original differential privacy definition) converges to GDP in the limit under composition. We also prove a Berry\u2013Esseen style version of the central limit theorem, which gives a computationally inexpensive tool for tractably analysing the exact composition of private algorithms. Taken together, this collection of attractive properties render f-DP a mathematically coherent, analytically tractable and versatile framework for private data analysis. Finally, we demonstrate the use of the tools we develop by giving an improved analysis of the privacy guarantees of noisy stochastic gradient descent.<\/jats:p>","DOI":"10.1111\/rssb.12454","type":"journal-article","created":{"date-parts":[[2022,2,22]],"date-time":"2022-02-22T02:33:23Z","timestamp":1645497203000},"page":"3-37","source":"Crossref","is-referenced-by-count":279,"title":["Gaussian Differential Privacy"],"prefix":"10.1093","volume":"84","author":[{"given":"Jinshuo","family":"Dong","sequence":"first","affiliation":[{"name":"Applied Mathematics and Computational Science, University of Pennsylvania , Philadelphia, Pennsylvania , USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aaron","family":"Roth","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Pennsylvania , Philadelphia, Pennsylvania , USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Weijie J.","family":"Su","sequence":"additional","affiliation":[{"name":"Wharton Statistics and Data Science Department, University of Pennsylvania , Philadelphia, Pennsylvania , USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2022,2,21]]},"reference":[{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"308","DOI":"10.1145\/2976749.2978318","article-title":"Deep learning with differential privacy","volume-title":"Proceedings of the 2016 ACM SIGSAC conference on computer and communications security","author":"Abadi","year":"2016"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"2867","DOI":"10.1145\/3219819.3226070","article-title":"The US Census Bureau adopts differential privacy","volume-title":"Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining","author":"Abowd","year":"2018"},{"key":"2023022408361634200_","volume-title":"Learning with privacy at scale","author":"Apple","year":"2017"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","DOI":"10.1017\/CBO9780511804090","volume-title":"Computational complexity: A modern approach","author":"Arora","year":"2009"},{"key":"2023022408361634200_","article-title":"Improving the Gaussian mechanism for differential privacy: Analytical calibration and optimal denoising","volume-title":"arXiv preprint","author":"Balle","year":"2018"},{"key":"2023022408361634200_","first-page":"6280","article-title":"Privacy amplification by subsampling: Tight analyses via couplings and divergences","author":"Balle","year":"2018","journal-title":"Advances in neural information processing systems"},{"key":"2023022408361634200_","article-title":"A face is exposed for AOL searcher no. 4417749","volume-title":"The New York times","author":"Barbaro","year":"2006"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"464","DOI":"10.1109\/FOCS.2014.56","article-title":"Private empirical risk minimization: Efficient algorithms and tight error bounds","volume-title":"2014 IEEE 55th annual symposium on foundations of computer science","author":"Bassily","year":"2014"},{"key":"2023022408361634200_","volume-title":"Comparison of experiments","author":"Blackwell","year":"1950"},{"key":"2023022408361634200_","article-title":"Deep learning with Gaussian differential privacy","volume-title":"arXiv preprint","author":"Bu","year":"2019"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"635","DOI":"10.1007\/978-3-662-53641-4_24","article-title":"Concentrated differential privacy: Simplifications, extensions, and lower bounds","volume-title":"Theory of cryptography conference","author":"Bun","year":"2016"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1145\/3188745.3188946","article-title":"Composable and versatile privacy via truncated CDP","volume-title":"Proceedings of the 50th annual ACM SIGACT symposium on theory of computing","author":"Bun","year":"2018"},{"issue":"5","key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"1888","DOI":"10.1137\/15M1033587","article-title":"Fingerprinting codes and the price of approximate differential privacy","volume":"47","author":"Bun","year":"2018","journal-title":"SIAM Journal on Computing"},{"key":"2023022408361634200_","article-title":"The cost of privacy: Optimal rates of convergence for parameter estimation with differential privacy","volume-title":"arXiv preprint","author":"Cai","year":"2019"},{"key":"2023022408361634200_","article-title":"Collecting telemetry data privately","volume-title":"Proceedings of advances in neural information processing systems 30 (NIPS 2017)","author":"Ding","year":"2017"},{"key":"2023022408361634200_","article-title":"The right complexity measure in locally private estimation: It is not the fisher information","volume-title":"arXiv preprint","author":"Duchi","year":"2018"},{"issue":"521","key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"182","DOI":"10.1080\/01621459.2017.1389735","article-title":"Minimax optimal procedures for locally private estimation","volume":"113","author":"Duchi","year":"2018","journal-title":"Journal of the American Statistical Association"},{"key":"2023022408361634200_","article-title":"Concentrated differential privacy","volume-title":"arXiv preprint","author":"Dwork","year":"2016"},{"key":"2023022408361634200_","first-page":"486","article-title":"Our data, ourselves: Privacy via distributed noise generation","volume-title":"Annual international conference on the theory and applications of cryptographic techniques","author":"Dwork","year":"2006"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1007\/11681878_14","article-title":"Calibrating noise to sensitivity in private data analysis","volume-title":"Theory of cryptography conference","author":"Dwork","year":"2006"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1109\/FOCS.2010.12","article-title":"Boosting and differential privacy","volume-title":"Foundations of computer science (FOCS), 2010 51st annual IEEE symposium on","author":"Dwork","year":"2010"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"650","DOI":"10.1109\/FOCS.2015.46","article-title":"Robust traceability from trace amounts","volume-title":"2015 IEEE 56th annual symposium on foundations of computer science","author":"Dwork","year":"2015"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"1054","DOI":"10.1145\/2660267.2660348","article-title":"Rappor: Randomized aggregatable privacy-preserving ordinal response","volume-title":"Proceedings of the 2014 ACM SIGSAC conference on computer and communications security","author":"Erlingsson","year":"2014"},{"key":"2023022408361634200_","article-title":"Bag of tricks for image classification with convolutional neural networks","volume-title":"arXiv preprint","author":"He","year":"2018"},{"key":"2023022408361634200_","article-title":"Challenges in the analyses of multidomain longitudinal data: Layered solutions","author":"Holmes","year":"2019"},{"issue":"8","key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"e1000167","DOI":"10.1371\/journal.pgen.1000167","article-title":"Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays","volume":"4","author":"Homer","year":"2008","journal-title":"PLoS Genetics"},{"issue":"6","key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"4037","DOI":"10.1109\/TIT.2017.2685505","article-title":"The composition theorem for differential privacy","volume":"63","author":"Kairouz","year":"2017","journal-title":"IEEE Transactions on Information Theory"},{"issue":"3","key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"793","DOI":"10.1137\/090756090","article-title":"What can we learn privately","volume":"40","author":"Kasiviswanathan","year":"2011","journal-title":"SIAM Journal on Computing"},{"key":"2023022408361634200_","first-page":"1097","article-title":"Imagenet classification with deep convolutional neural networks","volume-title":"Advances in neural information processing systems","author":"Krizhevsky","year":"2012"},{"key":"2023022408361634200_","volume-title":"MNIST handwritten digit database","author":"LeCun","year":"2010"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"263","DOI":"10.1109\/CSF.2017.11","article-title":"R\u00e9nyi differential privacy","volume-title":"2017 IEEE 30th computer security foundations symposium (CSF)","author":"Mironov","year":"2017"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"157","DOI":"10.1007\/978-3-662-49096-9_7","article-title":"The complexity of computing the optimal composition of differential privacy","volume-title":"Theory of cryptography conference","author":"Murtagh","year":"2016"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1109\/SP.2008.33","article-title":"Robust de-anonymization of large sparse datasets","volume-title":"2008 IEEE symposium on security and privacy","author":"Narayanan","year":"2008"},{"key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"1220","DOI":"10.1109\/ISIT.2011.6033729","article-title":"Shannon meets Blackwell and Le Cam: Channels, codes, and statistical experiments","volume-title":"2011 IEEE international symposium on information theory proceedings","author":"Raginsky","year":"2011"},{"key":"2023022408361634200_","article-title":"Privacy loss classes: The central limit theorem in differential privacy","author":"Sommer","year":"2018"},{"key":"2023022408361634200_","article-title":"Cs7880: Rigorous approaches to data privacy, Spring 2017","author":"Ullman","year":"2017"},{"key":"2023022408361634200_","volume-title":"Approximation algorithms","author":"Vazirani","year":"2013"},{"key":"2023022408361634200_","article-title":"Subsampled R\u00e9nyi differential privacy and analytical moments accountant","volume-title":"arXiv preprint","author":"Wang","year":"2018"},{"issue":"489","key":"2023022408361634200_","doi-asserted-by":"crossref","first-page":"375","DOI":"10.1198\/jasa.2009.tm08651","article-title":"A statistical framework for differential privacy","volume":"105","author":"Wasserman","year":"2010","journal-title":"Journal of the American Statistical Association"},{"key":"2023022408361634200_","article-title":"Bag of freebies for training object detection neural networks","volume-title":"arXiv preprint","author":"Zhang","year":"2019"},{"key":"2023022408361634200_","article-title":"Sharp composition bounds for Gaussian differential privacy via Edgeworth expansion","volume-title":"arXiv preprint","author":"Zheng","year":"2020"}],"container-title":["Journal of the Royal Statistical Society Series B: Statistical Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/rssb.12454","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1111\/rssb.12454","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/academic.oup.com\/jrsssb\/article-pdf\/84\/1\/3\/49324238\/jrsssb_84_1_3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/jrsssb\/article-pdf\/84\/1\/3\/49324238\/jrsssb_84_1_3.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,17]],"date-time":"2023-11-17T21:57:29Z","timestamp":1700258249000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/jrsssb\/article\/84\/1\/3\/7056089"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,1]]},"references-count":41,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2022,2,21]]},"published-print":{"date-parts":[[2022,2,1]]}},"URL":"https:\/\/doi.org\/10.1111\/rssb.12454","relation":{},"ISSN":["1369-7412","1467-9868"],"issn-type":[{"value":"1369-7412","type":"print"},{"value":"1467-9868","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2022,2]]},"published":{"date-parts":[[2022,2,1]]}}}