Reconstruction attacks on machine learning (ML) models pose a strong risk of
leakage of sensitive data. In specific contexts, an adversary can (almost)
perfectly reconstruct training data samples from a trained model using the
model's gradients. When training ML models with differential privacy (DP),
formal upper bounds on the success of such reconstruction attacks can be
provided. So far, these bounds have been formulated under worst-case
assumptions that might not hold high realistic practicality. In this work, we
provide formal upper bounds on reconstruction success under realistic
adversarial settings against ML models trained with DP and support these bounds
with empirical results. With this, we show that in realistic scenarios, (a) the
expected reconstruction success can be bounded appropriately in different
contexts and by different metrics, which (b) allows for a more educated choice
of a privacy parameter.

通过实验结果，我们在现实场景中提供了差分隐私机器学习模型下重构成功的明确上界，这有助于在不同上下文和度量标准下进行隐私参数的明智选择。