Package: prv-accountant
Privacy Random Variable (PRV) AccountantA fast algorithm to optimally compose privacy guarantees of differentially private (DP) algorithms to arbitrary accuracy.
Our method is based on the notion of privacy loss random variables to quantify the privacy loss of DP algorithms.
For more details see [1].Installationpip install prv-accountantMechanismsCurrently the following mechanisms are supported:Subsampled Gaussian Mechanismfromprv_accountantimportPoissonSubsampledGaussianMechanismprv=PoissonSubsampledGaussianMechanism(noise_multiplier,sampling_probability)which computes the privacy curve$$ \delta \left ( \mathcal{N}(0, \sigma^2) | (1-p) \mathcal{N}(0, \sigma^2) + p \mathcal{N}(1, \sigma^2) \right ), $$where $p$ is the sampling probability and $\sigma$ is the noise multiplier.
The second argument represents a mixture distribution.Gaussian Mechanismfromprv_accountantimportGaussianMechanismprv=GaussianMechanism(noise_multiplier)which computes the privacy curve$$ \delta \left ( \mathcal{N}(0, \sigma^2) | \mathcal{N}(1, \sigma^2) \right ), $$where $\sigma$ is the noise multiplier.Laplace Mechanismfromprv_accountantimportLaplaceMechanismprv=LaplaceMechanism(mu)which computes the privacy curve$$ \delta \left ( \textsf{Lap}(0, 1) | \textsf{Lap}(\mu, 1) \right ). $$Pure-DP and Approximate-DPIt is also possible to compose DP guarantees directlypure $\varepsilon$-DP guarantees usingprv_accountant.PureDPMechanism(epsilon)approximate $(\varepsilon, \delta)$-DP guarantees usingprv_accountant.ApproximateDPMechanism(epsilon, delta)Custom MechanismsIt is also possible to add custom mechanisms for the composition computation.
An example can be found inthis notebook.
All we need is to implement the CDF of the privacy loss distribution.ExampleHeterogeneous CompositionIt is possible to compose different mechanisms.
The following example will compute the composition of three different mechanism $M^{(a)}, M^{(b)}$ and $M^{(c)}$ composed with themselves $m, n$ and $o$ times, respectively.An application for such a composition is DP-SGD training with increasing batch size and therefore increasing sampling probability.
After $m+n+o$ training steps, the resulting privacy mechanism $M$ for the whole training process is given by $M = M_1^{(a)} \circ \dots \circ M_m^{(a)} \circ M_1^{(b)} \circ \dots \circ M_n^{(b)} \circ M_1^{(c)} \circ \dots \circ M_o^{(c)}$.Using theprv_accountantwe need to create a privacy random variable for each mechanismfromprv_accountant.privacy_random_variablesimportPoissonSubsampledGaussianMechanism,GaussianMechanism,LaplaceMechanismprv_a=PoissonSubsampledGaussianMechanism(noise_multiplier=0.8,sampling_probability=5e-3)prv_b=GaussianMechanism(noise_multiplier=8.0)prv_c=LaplaceMechanism(mu=0.1)m=100n=200o=100Next, we need to create an accountant instance.
The accountant will take care of most of the numerical intricacies such as finding the support of the PRV and discretisation.
In order to find a suitable domain, the accountant needs to know about the largest number of compositions of each PRV with itself that will be computed.
Larger values ofmax_self_compositionslead to larger domains which can cause slower performance.
In the case of DP-SGD, a reasonable choice ofmax_self_compositionswould be the total number of training steps.
Additionally, the desired error bounds for $\varepsilon$ and $\delta$ are required.fromprv_accountantimportPRVAccountantaccountant=PRVAccountant(prvs=[prv_a,prv_b,prv_c],max_self_compositions=[1_000,1_000,1_000],eps_error=0.1,delta_error=1e-10)Finally, we're ready to compute the composition.
The final bounds and estimates for $\varepsilon$ for the mechanism $M$ areeps_low,eps_est,eps_up=accountant.compute_epsilon(delta=1e-6,num_self_compositions=[m,n,o])DP-SGDFor homogeneous DP-SGD (i.e. constant noise multiplier and constant sampling probability) things are even simpler.
We provide a simple command line utility for getting epsilon estimates.compute-dp-epsilon --sampling-probability 5e-3 --noise-multiplier 0.8 --delta 1e-6 --num-compositions 1000Or, use it in python codefromprv_accountant.dpsgdimportDPSGDAccountantaccountant=DPSGDAccountant(noise_multiplier=0.8,sampling_probability=5e-3,delta=1e-6,eps_error=0.1,delta_error=1e-10,max_compositions=1000)eps_low,eps_estimate,eps_upper=accountant.compute_epsilon(num_compositions=1000)For more examples, have a look in thenotebooksdirectory.References[1]Sivakanth Gopi, Yin Tat Lee, Lukas Wutschitz. (2021). Numerical composition of differential privacy. Advances in Neural Information Processing SystemsContributingThis project welcomes contributions and suggestions.  Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
the rights to use your contribution. For details, visithttps://cla.opensource.microsoft.com.When you submit a pull request, a CLA bot will automatically determine whether you need to provide
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
provided by the bot. You will only need to do this once across all repos using our CLA.This project has adopted theMicrosoft Open Source Code of Conduct.
For more information see theCode of Conduct FAQor
contactopencode@microsoft.comwith any additional questions or comments.TrademarksThis project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft
trademarks or logos is subject to and must followMicrosoft's Trademark & Brand Guidelines.
Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
Any use of third-party trademarks or logos are subject to those third-party's policies.