Search papers, labs, and topics across Lattice.
This paper introduces Ball Differential Privacy (Ball-DP), a novel approach that mitigates data reconstruction threats by enforcing epsilon-delta indistinguishability over single-record substitutions within a defined radius in the embedding space. By allowing a smaller radius for local reconstruction threats, Ball-DP significantly reduces the noise required for privacy, thereby improving model accuracy without sacrificing security. Empirical evaluations demonstrate that this method enhances utility in high-privacy regimes, outperforming traditional differential privacy approaches.
Reducing noise in differential privacy can lead to significant gains in model accuracy while still effectively mitigating reconstruction attacks.
Vector embeddings of raw records, while not human-readable, do not preserve record privacy: an adversary can reconstruct training records from a released model even when that model is a simple convex classifier. Differential privacy (DP) is the principled defense, but its noise is calibrated to worst-case indistinguishability, hiding arbitrary single-record substitutions, including those far outside the set of plausible alternatives relevant to a reconstruction adversary. The result is noise far larger than what reconstruction robustness requires, degrading accuracy without a corresponding security benefit. We propose Ball-DP: enforcing epsilon-delta indistinguishability over single-record substitutions restricted to a ball of radius r under a distance metric d in the embedding space. A deployment facing only local reconstruction threats can choose a small r, thereby reducing noise and recovering accuracy. The radius makes the scope of the privacy claim explicit against reconstruction attacks; standard DP is recovered when r covers the entire admissible record domain. We provide noise calibrations for regularized convex learning problems under Ball-DP, and derive corresponding reconstruction-robustness certificates, called Ball-ReRo, that upper-bound an attacker's reconstruction success. By deriving the optimal finite-prior MAP reconstruction attack, we empirically audit Ball-ReRo certificates on seven benchmark learning tasks. Our experiments show that calibrating noise to Ball-DP improves utility, considerably exceeding the dilution of reconstruction robustness in high-privacy regimes, i.e., when epsilon is small.
