We study the problem of subsampling in differential privacy (DP), a question that is the centerpiece behind many successful differentially private machine learning algorithms. Specifically, we provide a tight upper bound on the R\'enyi Differential Privacy (RDP) (Mironov, 2017) parameters for algorithms that: (1) subsample the dataset, and then (2) apply a randomized mechanism M to the subsample, in terms of the RDP parameters of M and the subsampling probability parameter. This result generalizes the classic subsampling-based "privacy amplification" property of $(\epsilon,\delta)$-differential privacy that applies to only one fixed pair of $(\epsilon,\delta)$, to a stronger version that exploits properties of each specific randomized algorithm and satisfies an entire family of $(\epsilon(\delta),\delta)$-differential privacy for all $\delta\in [0,1]$. Our experiments confirm the advantage of using our techniques over keeping track of $(\epsilon,\delta)$ directly, especially in the setting where we need to compose many rounds of data access.

研究文章中，我们提供了差分隐私机器学习算法的紧密上界，特别针对在数据子抽样和应用随机化机制的情况下，考虑了Mironov（2017）的Renyi差分隐私参数和数据子抽样概率参数的影响，将Abadi等人（2016）针对高斯机制开发的矩计数技术推广到任何经过子抽样的RDP机制，此研究是关于差分隐私重要问题的研究。

子样本Rényi差分隐私和分析矩会计