How Do Input Attributes Impact the Privacy Loss in Differential Privacy?
This work addresses privacy concerns for individuals in machine learning by providing a method to analyze attribute-level privacy risks, though it is incremental as it builds on existing individual differential privacy frameworks.
The paper tackled the problem of understanding how individual input attributes affect privacy loss in differentially private neural networks, and introduced a new metric called Privacy Loss-Input Susceptibility (PLIS) to apportion privacy loss to specific attributes, enabling identification of sensitive attributes and high-risk subjects for data reconstruction.
Differential privacy (DP) is typically formulated as a worst-case privacy guarantee over all individuals in a database. More recently, extensions to individual subjects or their attributes, have been introduced. Under the individual/per-instance DP interpretation, we study the connection between the per-subject gradient norm in DP neural networks and individual privacy loss and introduce a novel metric termed the Privacy Loss-Input Susceptibility (PLIS), which allows one to apportion the subject's privacy loss to their input attributes. We experimentally show how this enables the identification of sensitive attributes and of subjects at high risk of data reconstruction.