We study privacy amplification for BandMF, i.e., DP-SGD with correlated noise across iterations via a banded correlation matrix. We propose $b$-min-sep subsampling, a new subsampling scheme that generalizes Poisson and balls-in-bins subsampling, extends prior practical batching strategies for BandMF, and enables stronger privacy amplification than cyclic Poisson while preserving the structural properties needed for analysis. We give a near-exact privacy analysis using Monte Carlo accounting, based on a dynamic program that leverages the Markovian structure in the subsampling procedure. We show that $b$-min-sep matches cyclic Poisson subsampling in the high noise regime and achieves strictly better guarantees in the mid-to-low noise regime, with experimental results that bolster our claims. We further show that unlike previous BandMF subsampling schemes, our $b$-min-sep subsampling naturally extends to the multi-attribution user-level privacy setting.

翻译：我们研究 BandMF（即通过带状相关矩阵在迭代间引入相关噪声的 DP-SGD）的隐私放大。我们提出 $b$-min-sep 子采样，这是一种新的子采样方案，它推广了泊松子采样和球桶子采样，扩展了先前针对 BandMF 的实用批处理策略，并在保持分析所需结构特性的同时，实现了比循环泊松子采样更强的隐私放大。我们通过利用子采样过程中马尔可夫结构的动态规划，基于蒙特卡洛核算给出了近乎精确的隐私分析。我们证明，在高噪声区域，$b$-min-sep 子采样与循环泊松子采样性能相当，在中低噪声区域则实现了严格更优的保证，实验结果也支持了我们的论断。我们进一步证明，与以往的 BandMF 子采样方案不同，我们的 $b$-min-sep 子采样可自然扩展至多归因用户级隐私设置。