Differential Privacy Best Practices

Practical guidance for deploying differential privacy in production ML systems. Privacy budget management, hyperparameter tuning, and avoiding common mistakes that can undermine your privacy guarantees.

Privacy Budget Management

• Set a total budget upfront: Decide your total ε before any analysis. Once set, do not increase it.
• Track cumulative spending: Use a privacy accountant to track exact spending across all queries and training steps.
• Use tight composition: Rényi DP or PLD-based accounting can save 2-5x on budget compared to basic composition.
• Prioritize analyses: Allocate more budget to high-value queries and less to exploratory ones.
• Avoid repeat queries: Cache results of DP queries. Re-running the same query on the same data wastes budget.

Hyperparameter Tuning Under DP

Hyperparameter tuning on private data costs privacy budget. Strategies to minimize this cost:

• Tune on public data: If a similar public dataset exists, tune hyperparameters there and transfer to private training.
• Use DP hyperparameter search: Allocate a small portion of your privacy budget for tuning. The Report Noisy Max mechanism can select the best hyperparameters privately.
• Start with known-good defaults: The DP community has established reasonable defaults for clipping norms and noise multipliers.
• Large batches, few epochs: This combination consistently works well for DP-SGD.

Improving Utility Under DP

1. Pre-train on Public Data

   Use public data for pre-training and private data only for fine-tuning. This dramatically reduces the privacy cost while maintaining accuracy.

2. Maximize Batch Size

   Larger batches improve the signal-to-noise ratio in DP-SGD. Use the largest batch size your hardware supports.

3. Feature Engineering

   Reduce input dimensionality before DP training. Fewer parameters mean less noise is needed per parameter.

4. Use Group Privacy Wisely

   If each person contributes k records, the effective privacy is kε. Limit per-user contributions to keep the guarantee strong.

Common Pitfalls

Reporting DP Guarantees

When publishing results from DP analyses, always report:

• The privacy parameters (ε, δ) achieved
• The composition method used for accounting
• The unit of privacy (per-user vs per-record)
• Any assumptions about data (bounds, group size limits)
• The DP library and version used