How to determine $\epsilon$ for each modules in GAP?

[elichienxD]

Hi @sisaman ,

Thanks for the great work and well-documented code base. I learn a lot from your work. I would like to know more details on how would you distribute the privacy budget over the three DP modules in GAP framework.

According to my understanding, GAP has three modules that needed to be made DP: encoder, PMA, classifier. Due to the Proposition 3 in the paper, we know that in order to achieve $(\alpha,\epsilon)$-RDP for the entire GAP framework, we have $\epsilon = \epsilon_1 + \epsilon_{PMA} + \epsilon_5$, assuming that encoder, PMA and the classifier modules are $(\alpha,\epsilon_1)$-RDP, $(\alpha,\epsilon_{PMA})$-RDP, $(\alpha,\epsilon_5)$-RDP respectively. Is it correct? (same argument holds even after DP conversion)

If so, then there is apparently a problem of how to distribute a given privacy budget $\epsilon$ into these three part, as different combinations will yield a different overall utility (test accuracy) in practice. After examine the code, I do not aware of such type of thing and there's also no discussion about this in the paper. Could you kindly explain how you deal with this problem?

Thanks,
Eli

[sisaman]

Hi @elichienxD,

We do not distribute the given privacy budget into the three components and calibrate the noise in each separately. Instead, we compose them together as a single privacy mechanism here and then calibrate the noise scale to the given $\epsilon$ value here.

More specifically, we consider the whole process as a composition of a series of Gaussian mechanisms (subsampled for the two DP-SGDs) with the same noise scale, which we calibrate in such a way that the privacy cost of this composed mechanism is equal to the given privacy budget. The calibration process automatically sets the found noise scale in all the individual Gaussian mechanisms.

I hope this helps clear things up. Feel free to let me know if you have any questions.

[elichienxD]

Hi @sisaman ,

Thank you so much for your timely response. I think it is clear to me now and will let you if I have follow-up issues. Really appreciate your great work!!

Best,
Eli