Differentially private training offers a protection which is usually interpreted as a guarantee against membership inference attacks. By proxy, this guarantee extends to other threats like reconstruction attacks attempting to extract complete training examples. Recent works provide evidence that if one does not need to protect against membership attacks but instead only wants to protect against training data reconstruction, then utility of private models can be improved because less noise is required to protect against these more ambitious attacks. We investigate this further in the context of DP-SGD, a standard algorithm for private deep learning, and provide an upper bound on the success of any reconstruction attack against DP-SGD together with an attack that empirically matches the predictions of our bound. Together, these two results open the door to fine-grained investigations on how to set the privacy parameters of DP-SGD in practice to protect against reconstruction attacks. Finally, we use our methods to demonstrate that different settings of the DP-SGD parameters leading to the same DP guarantees can result in significantly different success rates for reconstruction, indicating that the DP guarantee alone might not be a good proxy for controlling the protection against reconstruction attacks.

翻译：差分隐私训练提供了一种通常被解释为防御成员推理攻击的保证。这种保证通过代理扩展到其他威胁，例如试图提取完整训练示例的重建攻击。近期研究提供了证据表明：如果不需要防御成员攻击而仅需防止训练数据重建，则可通过使用更少噪声来抵御这些更具雄心的攻击，从而提升隐私模型的效用。我们以DP-SGD（用于隐私深度学习的标准算法）为背景进一步探讨该问题，为DP-SGD下任何重建攻击的成功率给出上界，并设计了一种实证匹配该界预测的攻击方法。这两项成果共同为实践中如何设置DP-SGD隐私参数以防御重建攻击提供了精细化研究路径。最后，我们利用所提出的方法证明：即使DP-SGD参数设置不同但产生相同的DP保证，其重建成功率也可能存在显著差异——这表明单独的DP保证可能并非衡量重建攻击防护能力的理想代理指标。