Differentially private stochastic gradient descent (DP-SGD) is the workhorse algorithm for recent advances in private deep learning. It provides a single privacy guarantee to all datapoints in the dataset. We propose an efficient algorithm to compute per-instance privacy guarantees for individual examples when running DP-SGD. We use our algorithm to investigate per-instance privacy losses across a number of datasets. We find that most examples enjoy stronger privacy guarantees than the worst-case bounds. We further discover that the loss and the privacy loss on an example are well-correlated. This implies groups that are underserved in terms of model utility are simultaneously underserved in terms of privacy loss. For example, on CIFAR-10, the average $\epsilon$ of the class with the highest loss (Cat) is 32% higher than that of the class with the lowest loss (Ship). We also run membership inference attacks to show this reflects disparate empirical privacy risks.

翻译：差异化的私人隐私性梯度下降(DP-SGD)是私人深层学习最新进展的工作马算法(DP-SGD),它为数据集中的所有数据点提供了单一的隐私保障。我们提出一个高效的算法,用于计算运行DP-SGD时个人案例的人均隐私保障。我们使用我们的算法调查一系列数据集中的每份隐私损失。我们发现,大多数例子享有比最坏的界限更强的隐私保障。我们进一步发现,一个例子的损失和隐私损失是完全相关的。这意味着,在模型效用方面服务不足的群体在隐私损失方面服务不足。例如,在CIFAR-10中,损失最高(Cat)的类别平均为32%,损失最低(Ship)的类别中,损失最高(Cat)的类别平均为32%。我们还进行成员推论攻击,以表明这反映了不同的经验隐私风险。