{"id":"https://openalex.org/W7161600536","doi":"https://doi.org/10.48550/arxiv.2605.15648","title":"Rethinking the Security of DP-SGD: A Corrected Analysis of Differentially Private Machine Learning","display_name":"Rethinking the Security of DP-SGD: A Corrected Analysis of Differentially Private Machine Learning","publication_year":2026,"publication_date":"2026-05-15","ids":{"openalex":"https://openalex.org/W7161600536","doi":"https://doi.org/10.48550/arxiv.2605.15648"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.15648","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15648","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.15648","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136415910","display_name":"Wenhao Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Wenhao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103162802","display_name":"Shujie Cui","orcid":"https://orcid.org/0000-0001-8124-6800"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cui, Shujie","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136435753","display_name":"Hui Cui","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cui, Hui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136440192","display_name":"Xingliang Yuan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yuan, Xingliang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.8537999987602234,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.8537999987602234,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.061900001019239426,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11612","display_name":"Stochastic Gradient Optimization Techniques","score":0.0406000018119812,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.5932999849319458},{"id":"https://openalex.org/keywords/normalization","display_name":"Normalization (sociology)","score":0.5088000297546387},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.47540000081062317},{"id":"https://openalex.org/keywords/private-information-retrieval","display_name":"Private information retrieval","score":0.47099998593330383},{"id":"https://openalex.org/keywords/information-leakage","display_name":"Information leakage","score":0.4666999876499176},{"id":"https://openalex.org/keywords/stochastic-gradient-descent","display_name":"Stochastic gradient descent","score":0.42969998717308044},{"id":"https://openalex.org/keywords/gradient-descent","display_name":"Gradient descent","score":0.41609999537467957},{"id":"https://openalex.org/keywords/implementation","display_name":"Implementation","score":0.40459999442100525},{"id":"https://openalex.org/keywords/differential-privacy","display_name":"Differential privacy","score":0.3806000053882599}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.729200005531311},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5932999849319458},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5263000130653381},{"id":"https://openalex.org/C136886441","wikidata":"https://www.wikidata.org/wiki/Q926129","display_name":"Normalization (sociology)","level":2,"score":0.5088000297546387},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4887000024318695},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.47540000081062317},{"id":"https://openalex.org/C99221444","wikidata":"https://www.wikidata.org/wiki/Q1532069","display_name":"Private information retrieval","level":2,"score":0.47099998593330383},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.4666999876499176},{"id":"https://openalex.org/C206688291","wikidata":"https://www.wikidata.org/wiki/Q7617819","display_name":"Stochastic gradient descent","level":3,"score":0.42969998717308044},{"id":"https://openalex.org/C153258448","wikidata":"https://www.wikidata.org/wiki/Q1199743","display_name":"Gradient descent","level":3,"score":0.41609999537467957},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.40459999442100525},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3880000114440918},{"id":"https://openalex.org/C23130292","wikidata":"https://www.wikidata.org/wiki/Q5275358","display_name":"Differential privacy","level":2,"score":0.3806000053882599},{"id":"https://openalex.org/C107321475","wikidata":"https://www.wikidata.org/wiki/Q5374254","display_name":"Empirical risk minimization","level":2,"score":0.3695000112056732},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.36399999260902405},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.3499999940395355},{"id":"https://openalex.org/C2779458634","wikidata":"https://www.wikidata.org/wiki/Q24963715","display_name":"Debiasing","level":2,"score":0.3384999930858612},{"id":"https://openalex.org/C163716315","wikidata":"https://www.wikidata.org/wiki/Q901177","display_name":"Gaussian","level":2,"score":0.33570000529289246},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3352000117301941},{"id":"https://openalex.org/C196083921","wikidata":"https://www.wikidata.org/wiki/Q7915758","display_name":"Variance (accounting)","level":2,"score":0.325300008058548},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.32440000772476196},{"id":"https://openalex.org/C97399411","wikidata":"https://www.wikidata.org/wiki/Q825367","display_name":"Coin flipping","level":2,"score":0.3034000098705292},{"id":"https://openalex.org/C4199805","wikidata":"https://www.wikidata.org/wiki/Q2725903","display_name":"Gaussian noise","level":2,"score":0.3000999987125397},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.2883000075817108},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.28760001063346863},{"id":"https://openalex.org/C2781170535","wikidata":"https://www.wikidata.org/wiki/Q30587856","display_name":"Noisy data","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.2703000009059906},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.2547999918460846},{"id":"https://openalex.org/C3017597292","wikidata":"https://www.wikidata.org/wiki/Q25052250","display_name":"Privacy protection","level":2,"score":0.250900000333786}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.15648","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15648","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.15648","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15648","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Differentially":[0],"Private":[1],"Stochastic":[2],"Gradient":[3],"Descent":[4],"(DP-SGD)":[5],"is":[6,19,35,49,98,125],"widely":[7],"used":[8],"to":[9,100,223],"protect":[10],"training":[11,39],"data":[12],"in":[13,26,37,195],"machine":[14],"learning.":[15],"Its":[16],"privacy":[17,47,53,159,188,229],"guarantee":[18,194,230],"commonly":[20],"analyzed":[21],"through":[22],"a":[23,32,52,62,71,108,227],"security":[24],"game":[25],"which":[27,55],"an":[28,117],"adversary":[29],"infers":[30],"whether":[31],"target":[33],"record":[34],"included":[36],"the":[38,42,57,65,90,101,121,129,135,146,151,158,164,180,186,192,214,232],"dataset":[40],"from":[41,107],"mechanism":[43],"output.":[44],"The":[45],"resulting":[46],"leakage":[48,189,212],"characterized":[50],"by":[51,128,134],"curve,":[54],"reports":[56],"false":[58,66],"negative":[59],"rate":[60],"as":[61,89,145],"function":[63],"of":[64,103,161],"positive":[67],"rate.":[68],"We":[69,156,198],"identify":[70],"mismatch":[72],"between":[73],"this":[74],"formal":[75],"analysis":[76],"and":[77,86,166,209,225],"common":[78],"DP-SGD":[79,85,162,203],"implementations.":[80],"Existing":[81],"analyses":[82],"often":[83],"model":[84],"its":[87],"variants":[88],"Subsampled":[91],"Gaussian":[92,96],"Mechanism":[93],"(SGM),":[94],"where":[95],"noise":[97],"added":[99],"sum":[102,124],"clipped":[104],"gradients":[105],"computed":[106],"Poisson-sampled":[109],"batch.":[110],"In":[111],"practice,":[112],"however,":[113],"many":[114],"implementations":[115],"apply":[116],"additional":[118],"normalization":[119],"step:":[120],"noisy":[122],"gradient":[123],"divided":[126],"either":[127],"expected":[130],"batch":[131,137],"size":[132],"or":[133,150],"sampled":[136],"size.":[138],"These":[139],"mechanisms":[140],"are":[141],"therefore":[142],"better":[143],"formalized":[144],"Expected-Averaged":[147],"SGM":[148,153],"(EASGM)":[149],"Batch-Averaged":[152],"(ASGM),":[154],"respectively.":[155],"re-analyze":[157],"guarantees":[160,175],"under":[163],"EASGM":[165],"ASGM":[167],"formulations.":[168],"Our":[169],"theoretical":[170],"results":[171],"show":[172],"that":[173,185],"these":[174],"can":[176],"be":[177],"weaker":[178],"than":[179],"standard":[181],"SGM-based":[182,215],"guarantee,":[183],"implying":[184],"true":[187],"may":[190],"exceed":[191],"reported":[193],"some":[196],"regimes.":[197],"further":[199],"audit":[200,219],"four":[201],"state-of-the-art":[202],"implementations,":[204],"including":[205],"Meta's":[206],"Opacus":[207,220],"library,":[208],"observe":[210],"empirical":[211],"beyond":[213],"guarantees.":[216],"Finally,":[217],"we":[218],"versions":[221],"v0.9.0":[222],"v1.5.4":[224],"derive":[226],"corrected":[228],"for":[231],"latest":[233],"implementation.":[234]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-19T00:00:00"}