{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T18:34:25Z","timestamp":1790620465555,"version":"4.1.0"},"reference-count":59,"publisher":"Association for Computing Machinery (ACM)","issue":"8","license":[{"start":{"date-parts":[[2022,12,23]],"date-time":"2022-12-23T00:00:00Z","timestamp":1671753600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"crossref","award":["H2020-871042 \u201cSoBigData++\u201d and H2020-101006879 \u201cMobiDataLab\u201d)"],"award-info":[{"award-number":["H2020-871042 \u201cSoBigData++\u201d and H2020-101006879 \u201cMobiDataLab\u201d)"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100005416","name":"Norwegian Research Council","doi-asserted-by":"crossref","award":["308904 \u201cCLEANUP\u201d"],"award-info":[{"award-number":["308904 \u201cCLEANUP\u201d"]}],"id":[{"id":"10.13039\/501100005416","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100002809","name":"Government of Catalonia","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100002809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100014013","name":"UK Research and Innovation","doi-asserted-by":"crossref","award":["MC_PC_21033 \u201cGRAIMatter\u201d and MCIN\/AEI \/10.13039\/501100011033 \/FEDER"],"award-info":[{"award-number":["MC_PC_21033 \u201cGRAIMatter\u201d and MCIN\/AEI \/10.13039\/501100011033 \/FEDER"]}],"id":[{"id":"10.13039\/100014013","id-type":"DOI","asserted-by":"crossref"}]},{"name":"UE","award":["PID2021-123637NB-I00 \u201cCURLING\u201d"],"award-info":[{"award-number":["PID2021-123637NB-I00 \u201cCURLING\u201d"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,8,31]]},"abstract":"<jats:p>We review the use of differential privacy (DP) for privacy protection in machine learning (ML). We show that, driven by the aim of preserving the accuracy of the learned models, DP-based ML implementations are so loose that they do not offer the<jats:italic>ex ante<\/jats:italic>privacy guarantees of DP. Instead, what they deliver is basically noise addition similar to the traditional (and often criticized) statistical disclosure control approach. Due to the lack of formal privacy guarantees, the actual level of privacy offered must be experimentally assessed<jats:italic>ex post<\/jats:italic>, which is done very seldom. In this respect, we present empirical results showing that standard anti-overfitting techniques in ML can achieve a better utility\/privacy\/efficiency tradeoff than DP.<\/jats:p>","DOI":"10.1145\/3547139","type":"journal-article","created":{"date-parts":[[2022,7,8]],"date-time":"2022-07-08T09:01:21Z","timestamp":1657270881000},"page":"1-16","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":87,"title":["A Critical Review on the Use (and Misuse) of Differential Privacy in Machine Learning"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1108-8082","authenticated-orcid":false,"given":"Alberto","family":"Blanco-Justicia","sequence":"first","affiliation":[{"name":"Universitat Rovira i Virgili, Tarragona, Catalonia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7275-7887","authenticated-orcid":false,"given":"David","family":"S\u00e1nchez","sequence":"additional","affiliation":[{"name":"Universitat Rovira i Virgili, Tarragona, Catalonia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7213-4962","authenticated-orcid":false,"given":"Josep","family":"Domingo-Ferrer","sequence":"additional","affiliation":[{"name":"Universitat Rovira i Virgili, Tarragona, Catalonia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7239-7356","authenticated-orcid":false,"given":"Krishnamurty","family":"Muralidhar","sequence":"additional","affiliation":[{"name":"University of Oklahoma, Norman, OK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,23]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2021.104468"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijmedinf.2018.01.007"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-53641-4_24"},{"key":"e_1_3_1_6_2","unstructured":"C. Canonne. 2021. What is \\(\\delta\\) and What Difference Does It Make? (11 Mar.2021). https:\/\/differentialprivacy.org\/flavoursofdelta\/."},{"issue":"3","key":"e_1_3_1_7_2","article-title":"Differentially private empirical risk minimization.","volume":"12","author":"Chaudhuri K.","year":"2011","unstructured":"K. Chaudhuri, C. Monteleoni, and A. D. Sarwate. 2011. Differentially private empirical risk minimization.Journal of Machine Learning Research 12, 3 (2011).","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.5555\/2612167.2612170"},{"key":"e_1_3_1_9_2","unstructured":"B. Cyphers. 2017. Differential Privacy Part 3: Extraordinary Claims Require Extraordinary Scrutiny. (30 Nov.2017). https:\/\/www.accessnow.org\/differential-privacy-part-3-extraordinary-claims-require-extraordinary-scrutiny\/."},{"issue":"429","key":"e_1_3_1_10_2","first-page":"2","article-title":"Towards a methodology for statistical disclosure control","volume":"15","author":"Dalenius T.","year":"1977","unstructured":"T. Dalenius. 1977. Towards a methodology for statistical disclosure control. Statistik Tidskrift 15, 429\u2013444 (1977), 2\u20131.","journal-title":"Statistik Tidskrift"},{"key":"e_1_3_1_11_2","first-page":"3571","volume-title":"Advances in Neural Information Processing System","author":"Ding B.","year":"2018","unstructured":"B. Ding, J. Kulkarni, and S. Yekhanin. 2018. Collecting telemetry data privately. In Advances in Neural Information Processing System. 3571\u20133580."},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/3433638"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-02347-7"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1007\/11787006_1"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/1866739.1866758"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1007\/11761679_29"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.29012\/jpc.689"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1561\/0400000042"},{"key":"e_1_3_1_19_2","article-title":"Concentrated Differential Privacy","author":"Dwork C.","year":"2016","unstructured":"C. Dwork and G. N. Rothblum. 2016. Concentrated Differential Privacy. arXiv preprint arXiv:1603.01887. (2016).","journal-title":"arXiv preprint arXiv:1603.01887"},{"key":"e_1_3_1_20_2","unstructured":"C. Edmond. 2020. How Statistical Noise is Protecting Your Data Privacy. (27 Aug.2020). https:\/\/news.microsoft.com\/on-the-issues\/2020\/08\/27\/statistical-noise-data-differential-privacy\/."},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660348"},{"key":"e_1_3_1_22_2","volume-title":"arXiv preprint arXiv:1712.07557NIPS 2017 Workshop: Machine Learning on the Phone and Other Consumer Devices","author":"Geyer R. C.","year":"2018","unstructured":"R. C. Geyer, T. Klein, and M. Nabi. 2018. Differentially private federated learning: A client level perspective. arXiv preprint arXiv:1712.07557. In NIPS 2017 Workshop: Machine Learning on the Phone and Other Consumer Devices."},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCI.2020.2976185"},{"key":"e_1_3_1_24_2","article-title":"How one of Apple\u2019s key privacy safeguards falls short","author":"Greenberg A.","year":"2017","unstructured":"A. Greenberg. 2017. How one of Apple\u2019s key privacy safeguards falls short. Wired (7 Sep.2017).","journal-title":"Wired"},{"key":"e_1_3_1_25_2","article-title":"Federated Learning for Mobile Keyboard Prediction","author":"Hard A.","year":"2018","unstructured":"A. Hard, K. Rao, R. Mathews, S. Ramaswamy, F. Beaufays, S. Augenstein, H. Eichner, C. Kiddon, and D. Ramage. 2018. Federated Learning for Mobile Keyboard Prediction. arXiv preprint arXiv:1811.03604.","journal-title":"arXiv preprint arXiv:1811.03604"},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2931068"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1002\/9781118348239"},{"key":"e_1_3_1_29_2","article-title":"Efficient Deep Learning on Multi-Source Private Data","author":"Hynes N.","year":"2018","unstructured":"N. Hynes, R. Cheng, and D. Song. 2018. Efficient Deep Learning on Multi-Source Private Data. arXiv preprint arXiv:1807.06689.","journal-title":"arXiv preprint arXiv:1807.06689"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.5555\/3361338.3361469"},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/1989323.1989345"},{"key":"e_1_3_1_32_2","article-title":"Federated Optimization: Distributed Machine Learning for On-Device Intelligence","author":"Kone\u010dn\u00fd J.","year":"2016","unstructured":"J. Kone\u010dn\u00fd, H. B. McMahan, D. Ramage, and P. Richt\u00e1rik. 2016. Federated Optimization: Distributed Machine Learning for On-Device Intelligence. arXiv preprint arXiv:610.02527.","journal-title":"arXiv preprint arXiv:610.02527"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2009.139"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.1145\/1217299.1217302"},{"key":"e_1_3_1_35_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR\u201918)","author":"McMahan H. B.","year":"2018","unstructured":"H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang. 2018. Learning differentially private recurrent language models. In Proceedings of the 6th International Conference on Learning Representations (ICLR\u201918)."},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.11"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23054"},{"key":"e_1_3_1_38_2","doi-asserted-by":"crossref","first-page":"487","DOI":"10.1080\/07350015.1988.10509697","article-title":"Disclosure risk and disclosure avoidance for microdata","volume":"6","author":"Paass G.","year":"1988","unstructured":"G. Paass. 1988. Disclosure risk and disclosure avoidance for microdata. Journal of Business & Economic Statistics 6 (1988), 487\u2013500.","journal-title":"Journal of Business & Economic Statistics"},{"key":"e_1_3_1_39_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR\u201917)","author":"Papernot N.","year":"2017","unstructured":"N. Papernot, M. Abadi, \u00da. Erlingsson, I. Goodfellow, and K. Talwar. 2017. Semi-supervised knowledge transfer for deep learning from private training data. In Proceedings of the 5th International Conference on Learning Representations (ICLR\u201917)."},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i10.17123"},{"key":"e_1_3_1_41_2","volume-title":"Proceedings of the Privacy in Machine Learning and Artificial Intelligence Workshop (ICML)","author":"Pihur V.","year":"2018","unstructured":"V. Pihur, A. Korolova, F. Liu, S. Sankuratripati, M. Yung, D. Huang, and R. Zeng. 2018. Differentially-private \u2018draw and discard\u2019 machine learning. In Proceedings of the Privacy in Machine Learning and Artificial Intelligence Workshop (ICML)."},{"key":"e_1_3_1_42_2","first-page":"61","article-title":"Membership inference attack against differentially private deep learning model","volume":"11","author":"Rahman A.","year":"2018","unstructured":"A. Rahman, T. Rahman, R. Lagani\u00e8re, N. Mohammed, and Y. Wang. 2018. Membership inference attack against differentially private deep learning model. Transactions on Data Privacy 11 (2018), 61\u201379.","journal-title":"Transactions on Data Privacy"},{"key":"e_1_3_1_43_2","article-title":"Learning for Emoji Prediction in a Mobile Keyboard","author":"Ramaswamy S.","year":"2019","unstructured":"S. Ramaswamy, R. Mathews, K. Rao, and F. Beaufays. 2019. Learning for Emoji Prediction in a Mobile Keyboard. arXiv preprint arXiv:1906.04329.","journal-title":"arXiv preprint arXiv:1906.04329"},{"key":"e_1_3_1_44_2","article-title":"Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models","author":"Salem A.","year":"2018","unstructured":"A. Salem, Y. Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes. 2018. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246.","journal-title":"arXiv preprint arXiv:1806.01246"},{"key":"e_1_3_1_45_2","volume-title":"Protecting Privacy When Disclosing Information: K-anonymity and Its Enforcement Through Generalization and Suppression","author":"Samarati P.","year":"1998","unstructured":"P. Samarati and L. Sweeney. 1998. Protecting Privacy When Disclosing Information: K-anonymity and Its Enforcement Through Generalization and Suppression. Technical Report. SRI International."},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813687"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00778-014-0351-4"},{"key":"e_1_3_1_49_2","first-page":"4848","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Tang H.","year":"2018","unstructured":"H. Tang, X. Lian, M. Yan, C. Zhang, and J. Liu. 2018. \\(D^2\\) : Decentralized training over decentralized data. In Proceedings of the International Conference on Machine Learning (PMLR), 4848\u20134856."},{"key":"e_1_3_1_50_2","doi-asserted-by":"publisher","DOI":"10.1016\/0378-3758(91)90047-I"},{"key":"e_1_3_1_51_2","article-title":"Emoji Frequency Detection and Deep Link Frequency","author":"Thakurta A. G.","year":"2017","unstructured":"A. G. Thakurta, A. H. Vyrros, U. S. Vaishampayan, G. Kapoor, J. Freudiger, V. V. Prakash, A. Legendre, and S. Duplinsky. 2017. Emoji Frequency Detection and Deep Link Frequency. US Patent 9,705,908. (2017).","journal-title":"US Patent 9,705,908"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9005465"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/3378679.3394533"},{"key":"e_1_3_1_54_2","volume-title":"Using Randomized Response for Differential Privacy Preserving Data Collection","author":"Wang Y.","year":"2014","unstructured":"Y. Wang, X. Wu, and D. Hu. 2014. Using Randomized Response for Differential Privacy Preserving Data Collection. Technical Report DPL-2014-003. University of Arkansas."},{"key":"e_1_3_1_55_2","volume-title":"Proceedings of the EDBT\/ICDT 2016 Joint Conference","author":"Wang Y.","year":"2016","unstructured":"Y. Wang, X. Wu, and D. Hu. 2016. Using randomized response for differential privacy preserving data collection. In Proceedings of the EDBT\/ICDT 2016 Joint Conference. Bordeaux, France."},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1965.10480775"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460427"},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.07.098"},{"key":"e_1_3_1_60_2","article-title":"Voting-based Approaches for Differentially Private Federated Learning","author":"Zhu Y.","year":"2020","unstructured":"Y. Zhu, X. Yu, Y.-H. Tsai, F. Pittaluga, M. Faraki, M. Chandraker, and Y.-X. Wang. 2020. Voting-based Approaches for Differentially Private Federated Learning. arXiv preprint arXiv:2010.04851.","journal-title":"arXiv preprint arXiv:2010.04851"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3547139","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3547139","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:02:55Z","timestamp":1750186975000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3547139"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,23]]},"references-count":59,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2023,8,31]]}},"alternative-id":["10.1145\/3547139"],"URL":"https:\/\/doi.org\/10.1145\/3547139","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,23]]},"assertion":[{"value":"2022-01-03","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-07-04","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-12-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}