We consider the problem of computing tight privacy guarantees for the composition of subsampled differentially private mechanisms. Recent algorithms can numerically compute the privacy parameters to arbitrary precision but must be carefully applied. Our main contribution is to address two common points of confusion. First, some privacy accountants assume that the privacy guarantees for the composition of a subsampled mechanism are determined by self-composing the worst-case datasets for the uncomposed mechanism. We show that this is not true in general. Second, Poisson subsampling is sometimes assumed to have similar privacy guarantees compared to sampling without replacement. We show that the privacy guarantees may in fact differ significantly between the two sampling schemes. In particular, we give an example of hyperparameters that result in $\varepsilon \approx 1$ for Poisson subsampling and $\varepsilon > 10$ for sampling without replacement. This occurs for some parameters that could realistically be chosen for DP-SGD.

我们考虑计算子采样差分私有机制组合的紧密隐私保证的问题。我们的主要贡献在于解决了两个常见的困惑：一是有些隐私估计者认为，子采样机制组合的隐私保证是通过自组合未组合机制的最坏情况数据集来确定的；二是泊松子采样有时被假设具有与无替换采样相似的隐私保证，但我们表明这两种采样方案的隐私保证可能存在显著差异。具体而言，我们给出了一个示例，其中泊松子采样的 ε≈1，而无替换采样的 ε>10。这对于实际可选择的DP-SGD参数而言是可能发生的。

在组合下避免子采样机制的隐私计算陷阱