# Bounding Training Data Reconstruction in DP-SGD

Source: [Bounding Training Data Reconstruction in DP-SGD](<https://www.sota2.com/research/paper/68fa71011e209131cea4e7b7>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-01-04T04:26:59.975Z

Authors: Jamie Hayes, Saeed Mahloujifar, Borja Balle

Published: 2023-02-14T18:02:34.000Z

## Abstract

Differentially private training offers a protection which is usually interpreted as a guarantee against membership inference attacks. By proxy, this guarantee extends to other threats like reconstruction attacks attempting to extract complete training examples. Recent works provide evidence that if one does not need to protect against membership attacks but instead only wants to protect against training data reconstruction, then utility of private models can be improved because less noise is required to protect against these more ambitious attacks. We investigate this further in the context of DP-SGD, a standard algorithm for private deep learning, and provide an upper bound on the success of any reconstruction attack against DP-SGD together with an attack that empirically matches the predictions of our bound. Together, these two results open the door to fine-grained investigations on how to set the privacy parameters of DP-SGD in practice to protect against reconstruction attacks. Finally, we use our methods to demonstrate that different settings of the DP-SGD parameters leading to the same DP guarantees can result in significantly different success rates for reconstruction, indicating that the DP guarantee alone might not be a good proxy for controlling the protection against reconstruction attacks.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Membership Inference Advantage Bounding on Uniform prior size 100](<https://www.sota2.com/research/sota/membership-inference-advantage-bounding-on-uniform-prior-size-100.md>): Membership Inference Advantage Bounding; Uniform prior size 100; Advantage Upper Bound: 1.2.

- [Membership Inference Advantage Bounding on Uniform prior size 10](<https://www.sota2.com/research/sota/membership-inference-advantage-bounding-on-uniform-prior-size-10.md>): Membership Inference Advantage Bounding; Uniform prior size 10; Advantage Upper Bound: 0.737.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2302.07225>)

[PDF](<https://arxiv.org/pdf/2302.07225.pdf>)