Amplified Patch-Level Differential Privacy for Free via Random Cropping
Authors: Kaan Durmaz
Jan Schuchardt
Sebastian Schmidt
Stephan Günnemann
Venue: Accepted by TMLR ()

Abstract: Random cropping is one of the most common data augmentation techniques in computer vision, yet the role of its inherent randomness in training differentially private machine learning models has thus far gone unexplored. We observe that when sensitive content in an image is spatially localized, such as a face or license plate, random cropping can probabilistically exclude that content from the model’s input. This introduces a third source of stochasticity in differentially private training with stochastic gradient descent, in addition to gradient noise and minibatch sampling. This additional randomness amplifies differential privacy without requiring changes to model architecture or training procedure. We formalize this effect by introducing a patch-level neighboring relation for vision data and deriving tight privacy bounds for differentially private stochastic gradient descent (DP-SGD) when combined with random cropping. Our analysis quantifies the patch inclusion probability and shows how it composes with minibatch sampling to yield a lower effective sampling rate. Empirically, we validate that patch-level amplification improves the privacy-utility trade-off across multiple segmentation architectures and datasets. Our results demonstrate that aligning privacy accounting with domain structure and additional existing sources of randomness can yield stronger guarantees at no additional cost.

Published in Transactions on Machine Learning Research (03/2026)
Amplified Patch-Level Differential Privacy for Free via Random Cropping
Kaan Durmaz
k.durmoz@tum.de
Technical University of Munich
Jan Schuchardt
Machine Learning Reseorch, Morgan Stanley Technical University of Munich
Sebastian Schmidt
sebustiano95.ccmmidd@elam..dd
Technical University of Munich
Stephan Günnemann Technical University of Munich
s. -.guennemoxnn@tum..ee
Reviewed OpenReview: https: https://openrevveau
openreview. net/ formfo id=pSWuUPBAVP
Abstract
Random cropping is one of the most common data augmentation techniques in computer vision, yet the role of its inherent randomness in training diffcrentially private machine learning models has thus far gone unexplored. We observe that when sensitive content in an image is spatially localized, such as a face or license plate, random cropping can probabilistically exclude that content from the model's imput. This introduces a third source of stochasticity in differentially private training with stochastic gradient descent, addition to gradient noise and minibatch sampling. This additional randomness amplifies differential privacy without requiring changes model architecture or training procodure. We formalize this effect by introducing a patch-level neighboring relation for vision data and deriving tight privacy bounds for differentially private stochastic gradient descent (DP-SGD) when combined with random cropping. Our analysis quantifies the patch inclusion probability and shows how it composes with minibatch sampling to yield a lower effective sampling rate. Empirically, we validate that patch-level amplification improves the privacy-utility trade-off across multiple segmentation architectures and datasets. Our results demonstrate that aligning privacy accounting with domain structure and additional existing sources of randomness can yield stronger guarantees at additional cost.
1 Introduction
Differential Privacy (DP) (Dwork 2006 Dwork and Roth 2014 provides a mathematically rigorous paradigm for privacy protection. It. limits the influence any individual data point on the outpul of a learning algo- rithm and offers provable safeguards against privacy attacks. For instance, it protects against membership inference (Shokri et al.) 2017), where an adversary attempts to determine whether particular data point part of the training set, and model inversion, where adversary tries reconstruct sensitive features from model outputs (e.g. faces from facial recognition algorithm (Fredrikson et al. 2015)). This guarantee holds regardless of the adversary's prior knowledge. It is formalized through neighboring relation, typically defined as two datasets differing in single data point, which denoled as ~ x'.
Full implementation details provided wiggittt..comm http://X--DDMM/pptcch_eeeeee

---

Published in Transactions on Machine Learning Research (03/2026)
Private Patch
Random Crop
Illustration of the effect of random cropping on a private patch as the license plate (in red). Left: Original image with designated private patch. Middle: A random crop that excludes the private patch. Right: A random crop that includes a part of the private patch. Any intersection allows the private patch to influence the output of the model.
Figure 1:
In deep learning, the most widely used method for achieving DP is DP-SGD (Song et al. 2013 Abadi et al. 2016). It is an elegant and simple modification of SGD, which works by adding noise to the clipped per- sample gradients. A key aspect of DP-SGD is amplification by subsampling, where privacy is enhanced by applying a differentially private mechanism to randomly selected batches from the dataset (Kasiviswanathan let al. 2008 Li et al., 2011). The idea behind this is that the private data contributes to each training step with only some small probability. Thus, the mechanism reveals less information about any single individual average, and the overall privacy cost. is reduced through structured randomness.
DP-SGD is broadly applicable across domains where datasets can be represented sets of arbitrary records, such as images (Abadi et al. 2016) or texts (Anil et al.] 2022). However, this generality also presents a limitation: it does not take advantage of domain-speciffec structure. In particular, stronger privacy guarantees may be possible when we (1) have additional knowledge about a domain, (2) can make more concrete assumptions about what constilutes private information, and (3) are able to redefine the neighboring relation to better match the nature of privacy risks in that domain. This opens the door more refined and tighter privacy mechanisms that are still formally sound, but better aligned with how sensitive information manifests and is structured across different domains.
Building on this motivation, in this work we take advantage of domain-specific structure in vision. In many real-world vision applications, privacy-sensitive content is not spread across the entire image, but instead localized to small, well-defined patches: a face in a photo, a license plate in a traffic scene. In such cases, assuming that the entire image is private is unnecessarily conservative. Instead, it more natural to define privacy at the patch level. This motivates a patch-level neighboring relation, where datasets differ by a small modification inside one image, leaving the rest untouched.
Under this proposed patch-level notion of privacy, we investigate whether the privacy guarantees of DP- SGD can be improved. Our central observation is that we can leverage an already standard component of most vision training pipelines, random cropping. Cropping selects a random subregion or crop of each image in a minibatch during training and commonly used to improve generalization and reduce compute in high-resolution tasks (Krizhevsky al., 2012; Cordts et al. 2016 Chen et al.) 2017 2018: Shorten and Khoshgoftaar 2019). When private information is spatially localized, cropping introduces a powerful, implicit form of randomness which can exclude the sensitive region entirely from the crop. This implicit randomness of cropping introduces stochasticity at the patch level within each image, analogous to the stochasticity at the dataset level introduced by minibatch sampling.
In this work, we formalize the analogy between cropping and minibatch sampling to rigorously analyze the resulting mechanism. Specifically, we:
introduce spatially localized, patch-level neighboring relation tailored to privacy in vision data,
formalize random cropping as a privacy amplification mechanism and show that probabilistically excludes sensitive regions,
2

---

Published in Transactions on Machine Learning Research (03/2026)
provide tight theoretical privacy analysis under this new neighboring relation, demonstrating reduced sensitivity and improved privacy bounds for DP-SGD.
Importantly, our approach requires no changes to the training algorithm and introduces no additional com- putational overhead, making it a drop-in improvement in the privacy accounting of DP-SGD. The only assumption we make is that private information is spatially localized, an intuitive and realistic condition in many practical vision tasks.
We empirically validate our findings on semantic segmentation with DeepLabV3+ (Chen et al., 2018 and PSPNet. (Zhao al., 2017) trained Cityscapes (Cordts al. 2016) and A2D2 (Geyer et al., 2020). demonstrating that random cropping improves the privacy-utility trade-off in realistic training scenarios. We view this work as step toward harnessing more sources of randomness already present in machine learning pipelines to achieve stronger privacy guarantees.
2 Related Work
Privacy in Computer Vision. A large body of prior work addresses the problem of releasing images in privacy-preserving manner, i... obfuscating private information directly in images. Classical approaches such blurring, pixelation, mosaicing are intuitive but offer protection against modern deep learning based attacks, which can often recover obfuscated content (McPherson ct al. 2016 Oh ct al.] 2016). To address such model-based threats, some recent. works explore GAN-based anony mization (Sun et. al. 2017 Wu et al., 2019). Another direction seeks to minimize data exposure via encrypted processing (Dowlin et al, 2016). While effective for specific release scenarios, these approaches focus on privatizing the output images rather than the models trained on them.
Differential Privacy for Vision Models. DP-SGD (Abadi et al. 2016) is the standard approach for training differentially private models. However, recent works highlight that maintaining utility at scale requires extensive hyperparameter tuning and compute, but also places increasing importance on strong data augmentation to stabilize training and improve generalization (Ponomareva et al. 2023 Sander et al. 2022 De et al. p In response to these challenges, some alternative approaches emerged that modify the training process, model architecture, or neighboring relation. AdaMix (Golatkar et al. 2022) improves utility in mixed differential privacy by using a small amount of task-aligned public data for adaptive model initialization and training. However, its effectiveness depends on the availability of labeled public data closely matching the target distribution. Dm-Ima (Liu et al. 2021 achieves differential privacy by adding noise to encoder outputs and reconstructing samples with denoising GAN. However, the method is geared toward releasing visually acceptable images and is not evaluated against standard DP training methods like DP-SGD, leaving open questions about its utility for downstream lcarning. PixcIDP (Lécuyer et al., 2018) connects advesaaiill robustness and differential privacy by enforcing guarantees against inpul perturbation at inference. While one can view this as a form of fine-grained privacy, its objective is fundamentally different: They focus robustness against perturbations during inference, whereas we focus on privacy during training. Unlike all of the previously discussed methods, which require architectural changes or public data, we retain the standard DP-SGD training algorithm but improve its privacy analysis by accounting for the inherent randomness of commonly used data augmentations.
Privacy Amplification via Structured Randomness. Privacy amplification by subsampling is a core principle differential privacy and is already leveraged in DP-SGD through minibatch sampling. Building on this, a few works have explored how other types of structured randomness in training can further improve privacy. Dong et al. (2025) focus on partial participation mechanisms. A key example they discuss is dropout, which introduces randomness over model parameters and thus amplifies privacy. However, De et al. (2022) found that parameter-level regularization techniques such as weight decay and dropout harm both training and validation performance in DP settings. In contrast, our work focuses on input-level augmentation. Schuchardt et al. (2025) show that combining minibatch sampling with additive Gaussian data augmentation can amplify privacy in time series forecasting. Their analysis proves that the Gaussian noise has similar effect to subsampling in amplifying privacy. This anplifiattoo--b--agmeeent byaugmentatnnn result is derived for relaxed neighboring relation that bounds both the number and magnitude of changes to sequences. Our work focuses
3

---

Published in Transactions on Machine Learning Research (03/2026)
different data domain (images), different form of data augmentation (cropping). and does not make any assumptions about the magnitude of change. Similar to Lécuyer et. al. (2018) Lin et al. (2021) provide a formal analysis of random cropping as a defense against adversarial attacks, establishing a connection between adversarial robustness and differential privacy. However, their analysis focuses on inference-time robustness and privacy, whereas we study training-time privacy guaranlees through DP-SGD.
3 Background and Preliminaries
Differential Privacy. Differential Privacy (DP) (Dwork 2006) formalizes the requirement that the output of randomized algorithm remains nearly unchanged when single individual's data is modified. Let X denote the space of datasets. A randomized mechanism M X + R is said to satisfy DP if the distributions of (z) and M(x') are almost indistinguishable whenever and x' are neighboring datasets (denoted x = x'),
meaning they differ in the data associated with a single individual. Formally:
Definition A mechanism M : X + RRD satisfies (e, (e, for all measurable subsets C CRR and for all x' X such that x = x', Pr[M(x) O] S ef (z' E +
This condition equivalently be expressed in terms of the hockey-stick divergence between Mx) and M(x)::
Proposition 1. Barthe and Olmedo, 2013) Let Ha(P))Q) = SRP max (e, (e, if and only il Her (M[)) ((x))))))))
dQ (0( a, a.0] dQ(o). ) Then M is
As Proposition suggests, and following the literature (e.g., Barthe and Olmedo 2013 and Zhu et al. 2022 we use and e interchangeably throughout the manuscript.
Neighboring Dataset Relations. The choice of neighboring relation x = x' depends on the application. Two standard variants are: The insertion /reemvvl/reeovl relation, denoted x =1 x', which holds when x' is obtained by adding or removing a single element: x' = x U {a} or x' = x > {a} for some element a. The substitution relation, denoted = x', which holds when æ and x' have the same size and differ in one entry: x' {a) {a') for some a, a'.
Subsampling. We consider a random subsampling scheme S X + Z and an d'',8')DP base mechanism B 2 + R.. The subsampled mechanism M = B B S first draws random batch from the dataset and then applies the base mechanism to this batch.
Proposition 2. Let X, C X denole the set of dalasels of size n. For m S n, define the subsampling without replacement mechanism Swo Xn + Z such that, given dotaset Xa, the mechanism Swo (x) outputs a subset y of size [y] =m drawn uniformly at random (i.e. y = Xmn) Then the sampling rate is Ywo= m/n.
While our methods apply to arbitrary subsampling schemes, in practice we focus on subsampling without replacement as in Proposition 2 The following standard result makes explicit how the sampling rate y of such a scheme enters the privacy guarantees.
Proposition [Ullman] 2017 Balle et al. 2018 If M' an (s', DDP randomized mechanism, then -1)). å 70', where y is the sampling rate of the M M' o S obeys (E, (e,8)-DP with log 1 7 subsampling scheme.
Dominating Pairs. In DP-SGD (Song et al. 2013 Abadi et al., 2016) the mechanism M is single training step. Therefore, during a training run, we apply M repeatedly. To determine the resulting (e, 8) different privacy accountants can be used (Koskela et al.] 2020 Meiser and Mohammadi 2018 Dong et al. 2022
Sommer et al. 2019). Recently, Zhu et al. [2022] introduced the nolion of dominaling puirs, which fully characterizes the tradeoff between E and 8, providing a unifying framework for tracking the privacy loss of composed mechanisms.
Definition 2. Let M be a randomized mechanism. A pair of distributions (P, Q) with densities (p. q) said be a dominating pair for M iff Ha(M(x) M(()))) S (a(P)) || Q) for all x' and all 2 0, where Ha denotes the slikey-stick divergence.

---

Published in Transactions on Machine Learning Research (03/2026)
Proposition 4. a dominaling pair.
Zhu et al. 2022 For the Gaussian mechanism, (P.Q) with P P: is
While Proposition provides simple and intuitive privacy amplification bound for 0 (i.c., a 1), it does not cover the complementary regime S 0 (i.e., 0 < S 1). To address this gap, we turn to the notion of dominating pairs, which yields more general subsampling bound valid across the entire range of e.
Proposition 5. [Zhu et al. 2022 Let M be mechanism with dominating pair (P. under the substitution relation =a and 5m the subsampling mechanism from Proposition the composed mechanism M a Sm. Rr + R.D satisfies:
2 with sampling rate Two m/n. Then
Ha((1 QQ + Two P1I for 2 1, [I
8 Mos (a)
m
+ wwoQ) for 0 c<a<l.
This result provides tight upper bound on the privacy profile of the subsampled mechanism. We will later improve upon this bound by leveraging the interaction of random cropping and patch-level privacy,
4 Privacy Amplification via Random Cropping
We study a form of privacy amplification that arises uniquely in vision models trained with data augmen- tations. Specifically, we show that the spatial structure of visual data, combined with random cropping, naturally gives rise to an amplification effect akin to that provided by minibatch subsampling in DP-SGD. Our analysis formalizes this intuition through the notion of patch-level differential privacy-
This section introduces the key components of our framework. First, define a patch-level neighboring relation that captures localized substitutions within an image. Second, we model random cropping as a stochastic transformation over padded images. Finally, we characterize how often a fixed region of interest appears in a random crop, and use this to derive privacy bounds under patch-level substitutions.
4.1 Patch-Level Neighboring Relation
As previously introduced, differential privacy is defined with respect to neighboring relation, which specifies when two datasets considered adjacent. To capture localized privacy risks in vision tasks, we define a neighboring relation for bounded spatial regions in a single image. Specifically, we define it as the substitution of rectangular patch. Substitution is natural choice because insertion or removal would alter the size or structure of an image (incompatible with fixed-shape learning pipelines), while substitution preserves structure and realistically captures localized, contiguous changes of data.
denote the set of input images with - channels and spatial dimensions H1 x W,. Define X' as the space of dalasets of faxed size n, where each dalasel x ( E X consists of n images x; E I. Let R C [H1] x [Wr] be a fixed rectangular region of pixel coordinates (i.e., a patch). We write x, (s(s)) for the pizel value coordinates (s,t) in image x, of dataset x. We say that two datasets x, X are patch-level substitution neighbors, denoted x =ap x', if there exists an inder E [n] and a region R such that x. x', for all j + i, and Is(,, =((8,t) for all pizels (s,1) & R, bul 24(s,t) ts(stt) for some pizels (s,t) E R.
Definition 3. Let := [0, 255]3x
==
Tn)
In other words, the datasets differ only in a single spatially localized region R within a single image, and are otherwise identical. Notably, even single-pixel change within R suffices to constitute adjacency. This formulation aligns with many real-world privacy scenarios in vision, where sensitive content is confined to a localized area, as discussed in the introduction, and serves as the foundation for our analysis of spatially- aware privacy mechanisms. At its core, this nolion is analogous to the usage of record-level DP (protecting individual data points) (Dwork et al.) 2006 Dwork 2006), compared to user-level DP (protecting all data from a single user) (Levy et al. 2021). ). Coarser relations are always valid, but finer-grained relations yield tighter guarantees when domain structure permits. We provide detailed discussion of when patch-level privacy is appropriate versus record-level privacy in Appendix
5

---

Published in Transactions on Machine Learning Research (03/2026)
4.2 Random Cropping Stochastic Mechanism
Random cropping introduces stochasticity at the spatial level by selecting subregions of an image. It is primarily used as data augmentation technique to improve generalization (Krizhevsky et al., 2012 Shorten and Khoshgoftaar 2019h, but this randomness can also be interpreted as a stochastic transformation, akin to minibatch sampling in DP-SGD. To formalize random cropping, we first account for the fact that, in practice, images could be symmetrically padded before cropping- Padding enlarges the spatial domain without altering the image content, and all subsequent operations are then performed on the padded image. Given an image to denote the corresponding symmetrically padded image, where padz; pad, E No are the horizontal and vertical padding sives. In the following, all coordinates are defined with respect to the padded image, using bottom-left origin.
2, I, use 2; [0, 255]sx (W)
Definition 4. Let Hc x We be a fixed crop size, The set of valid crop origins is Q == ((u, E No 0 a S W1 2pad, Wo, 0 0s0 v S H1 + 2pad, Hc) For each origin (u, v) E Q2 the cor- responding crop region is Cu. = [(,,s) E Ng u S + Wc, u USJ ssjuut Hc}.
In words, Definition specifies the set of all possible rectangular windows of size He We that can be extracted from the padded image.
Definition 5. The random cropping mechanism S : I + Ic samples a crop origin (u,v) ~ Uni from the set of valid origins (Definition 4 and returns
(etop(xz) == Dc C.,.'
(1)
where Ty is the padded image and Ze Ca.. denotes its restriction to the crop region Cu.v-
4.3 Patch Inclusion Probability
To analyze privacy amplification under patch-level substitution, we first need to quantify how likely is that sensitive region is included in crop. If a private patch is excluded entirely, the mechanism's output becomes independent of that region, meaning it cannot influence the gradient. Conversely, any intersection mcans the private region can influence the output. This motivates the definition of the patch inclusion probability, i.e., the probability that a randomly chosen crop intersects with region R.
Definition 6. Let S. No be fized rectangular region in the padded image. Let QR == {(u, v) E C 0} be the set of crop origins for which the corvesponding crop region Cu,y intersects R. Then the patch-level inclusion probability is Teoop (R)
10g
[2
Intuitively, this probability increases with crop size and decreases with image size. Under the neighboring relation "A,p; two datasets differ only in a single spatially localized region R. In analogy to standard amplification by subsampling, where each record is included with some probability, we treat Yero as the sampling rate at which the private region is included in the mechanism's input. We now derive a closed-form expression for this quantity, assuming a fixed patch location.
Lemma 1. Let R C N3 be fixed rectangular private patch in the original image, with bottom-left coordinate (Rz, Ry) and size H x WR- After applying symmetric padding of pad, pizels horizontally and pad, pizels vertically, we denote its bottom-left coordinate in the padded image by R' = R2 + pad., R2 = Ry + pady. Let (Xmins Ymin) and (Xmax; Ymax) denote the minimuum and marimum crop origins for which the crop region Cu,y intersects R. These are given by:
X Xmi max (0, R' We + 1),
Xmax min (W, + 2pad We, R + WR 1), Ymax min (H, + 2pad, Hc, R2 + HR - 1).
Y Ymnn max (0, R² - He + 1),
Then, the patch-level inclusion probability (Definition 0 is:
(Xmax Xmii + 11) (Ymax maaxx Ymin + 1) Yerop! (R) (W, + 2 pad, We + 1) (H, + 2 pad, - Hc + 1)*
(2)
Proof. See Appendix B.1
6

---

Published in Transactions on Machine Learning Research (03/2026)
4.4 Worst- Case Private Patch Exposure
The definition of (Rt) above provides the inclusion probability for a fixed patch location R. For sound privacy guarantees, however, we need to account for the worst-case placement of the private region, i.e., the position that maximizes its inclusion probability and thus its potential privacy exposure.
Definition 7. The worst-case case patch inclusion probability is defined as Ycro == max Terop( where the mazimization ranges over all valid placements of R within the padded image domain.
2 Theorem 1. Let Reenter [[" | [) denote the centrally placed patch. Then, the worst-case patch inclusion probability is achieved at Reenter, i.e,, arg max Yerap( = Reenter
R
Proof. See Appendix B.2
The patch inclusion probability quantifies an image-level stochasticity that is distinct from, and composes naturally with, the minibatch-level sampling performed in DP-SGD. Specifically, each image undergoes two layers of randomness: first, random cropping at the patch level, and second, dataset-level minibatch subsampling without replacement.
This leads to an effective sampling rate "Yfft == "wo "eropp where Two = m/n n is the minibatch sampling rate and Yerop is the worst-case patch inclusion probability. We now state a result that makes this interaction explicit. terms of differential privacy.
Theorem 2. Let M be a mechanism that is dominated by P.Q. under the substilution relation =A- Lel Sw denote without-rest replacmmett subsampling of minibatch size and Serop the random cropping mechanism we defined in Definition 5 Then, under the patch-level substitution relation =a.p, the composed mechanism M o Strop Swo salisfies
Ha
((1 - Yefr + 7ett PI Q) 1/
M (a)
(3)
Ha (P - (11-- Tea Q) f0<a<l,
where "offf := 7- "Yeopp with minibatch sampling rate m. and worst-case patch inclusion probability "lerop.
Proof. See Appendix B.3
This theorem captures the central insight of our work. It shows that the randomness already present in data augmentation, i.c., random cropping, can be leveraged as an additional source of privacy amplification for free. This amplification is possible because we adopt spatially localized neighboring relation, which aligns the privacy definition with the structure of vision data. Together, these elements explain why, for any minibatch sampling rate our privacy guarantees are strictly stronger than the usual tight analysis of DP-SGD from Proposition 5 would suggest. Not only are the guarantecs strictly stronger, but one can also control both sources of randomness independently to attain a wider range privacy-utility trade-ofTs.
Tightness for DP-SGD. Eq 3 provides sound upper bound for arbitrary mechanisms. In B.4 we additionally prove that the bound holds with equality when P, Q are a tight dominating pair of the mechanism M: : : R that maps batches of cropped images to clipped, noised, and averaged gradients for some worst-case model f. Without further assumptions about the model, it is therefore the strongest possible privacy guaranty that can be derived for DP-SGD with patch-level subsampling.
Generalization to Arbitrary Regions. While we assume rectangular patches here for clarity and tractability, the same reasoning applics to other shapes as well. For certain simple geometries such as circular regions (e.g., faces), it may still be possible derive closed-form inclusion probabilities. For ir- regular blobs, however, no compact expression exists, and the probability must instead be calculated using computational methods. The more faithfully the private region is modeled by its true structure, the less conservative the assumptions need to be, resulting in tighter inclusion probability bounds and correspond- ingly stronger privacy amplification from domain-specific knowledge. We demonstrate this empirically with varied geometries in Appendix 0.1.6.
Generalization to Multiple Patches. Our analysis extends naturally images containing multiple
disjoint sensitive regions. One could (1) use the group privacy property of DP (Vadhan 2017), (2) assume
7

---

Published in Transactions on Machine Learning Research (03/2026)
the union of these patches as single private blob and directly use our tight analysis discussed above. In either case, the worst-case limit of multiple patches covering the ent image recovers standard DP-SGD.
1.0
1.0
Patch-Level Subsampling
Patch-Level Subsampling
Miuibatch Subsamapiing
Minibatch Subsampling
0.8
Data-Leva Noise
Data-Level Noise
0.6
0.6
6iE)
0.4
0.4
0.2
0.2
0.0
10
10"
10a
10
10
10
10
10
10
E
E
(a) Private patch 10 10
(b) Private patch 20 20
Figure 2: Privacy profiles for different mechanisms. DP-SGD with patch-level subsampling (blue) achieves stronger privacy amplification compared to standard minibatch subsampling (orange) with identical o = 1. Even with an an extremely large noise scale Odata = 1000, data-level noise addition (green) is less private.
5 Experimental Evaluation
We now empirically investigate the impact of patch-level subsampling on both privacy guarantees and model utility. Our goal is to understand how patch-level differential privacy interacts with key parameters and to validate that patch-level amplification provides langible advanlages over standard subsampling strategies. When we refer to patch-level subsampling, we mean this mechanism applied on top of standard minibatch subsampling. We organize our results into three parts. (1) Direct comparison of privacy profiles across different sampling strategies, (2) dependence of privacy amplification on crop and patch size, and (3) privacy- utility tradeoffs under patch-level subsampling versus standard minibatch subsampling.
5.1 Srechanis--Specifee Privacy Profiles
To begin, we compare the privacy of three mechanisms in isolation: standard DP-SGD with minibatch subsampling, our patch-level sampling combined with minibatch subsampling, and a baseline where Gaussian noise is added directly to the input images. This highlights the privacy properties of patch-level amplification independently of downstream training performance.
For all methods, compute the privacy profile 5(E) as function of We use fixed setup with crop size 100 x 100, private patch sizes 10 x 10 (Figure 2al and 20 x 20 (Figure 2bp. For the two subsampling methods, we assume a Gaussian noise multiplier о 1. Since the privacy profiles are sensitive to many
hyperparameters (as discussed in (Ponomareva et al. 2023 Sander et al. 2022 De et al. 2022)), ), we report
results here for this representative configuration and defer additional combinations to Appendix D.1
The data-level noise addition baseline included to address a natural question: can a simpler alternative, such as directly adding Gaussian noise the input pixels before training, provide comparable privacy guarantees? We scale the noise using the expected sensitivity of localized private patch, parallel to method. In particular, we compute the éz-sensitivity as A, == 255 v3 Hn Wn. where H Wn are the side lengths of the private region.
Figure 2 shows the resulting privacy profiles. Patch-level sampling (blue) consistently achieves lower privacy leakage across a wide range of e values compared to standard DP-SGD (orange), confirming that incorporat- ing spatial structure into the mechanism leads stronger privacy guarantoes. It also strictly outperforms the noise addition baseline (green): even with a noise standard deviation as large as ddata 1000, privacy
8

---

Published in Transactions on Machine Learning Research (03/2026)
is uniformly worse than with patch-level subsampling. This extreme noise level further exceeds the dynamic range of non-normalized image pixels [0, 255], underscoring the impracticality of uniform noise injection DP strategy for visual data.
2.2
Patch-Level Subeampling
Patch-Level Subsampling
2.0
Minibatch Subeampling
Minibatch: Subssmpling
2.0
1.5
1.6
1.0
1.2
4.5
4.5
5
0.0
0
200
400
600
0
20
40
60
80
100
120
Crop side length [pixels]
Private patch side length [pixels]
Figure 3: Varying crop size for patch-level subsam- pling, for different noise levels and = 10-5. The privacy parameter & increases rapidly with the crop size. All curves saturate at the minibatch subsam- pling baseline once the intersection probability be- comes
Figure 4: Varying private patch size for patch-level subsampling, for different noise levels and = 10 10-5, The privacy parameter с increases approximately linearly with the size of the private patch. All curves saturate the minibatch-one baseline once the in- tersection probability becomes 1.
5.2 Influence of Crop and Patch Size on Privacy
We now analyze how the privacy parameter varies with crop size and private patch size for three different noise levels. These factors determine the inclusion probability of the private region, which directly affects the effective sampling rate Yeff = Two "erop- We apply Thcorem 2 to compute E from "iff using PLD accounting. the first experiment, we vary the crop size with fixed private patch size 10 10. the second, we fix the crop size at 450 450 and vary the private patch size from to 120 pixels. We set = 1/epoch_ssteeeeeeeeeeeeeeeee sipech_sizeeee size and assume epoch sizee_sieee 10 In this section, we report results with Gaussian noise multipliers E {4.0, 4.5, 5.0}, which keep in practically relevant interval and yield clearly interpretable plots. In Appendix D.2 we repeat the experiments with wider range of noise values. All findings remain consistent with the ones shown here.
Figure g shows that e increases rapidly with crop size. In standard training, crop size is a hyperparameter that affects model performance. Our evaluation further indicates that also influences privacy: larger crops yield higher E, which turn requires stronger noise for a fixed privacy budget. This creates an additional link between crop size and model performance. Figure shows approximately linear increase in private patch size grows. An important point is that both curves saturate at cutoff, reaching the minibatch subsampling bascline. This occurs when the intersection probability reaches 1, mcaning the private patch is included in every crop and contributes to the gradient whenever the image is selected. In this regime, patch-level subsampling becomes equivalent to standard minibatch sampling.
These results show that the strength of patch-level amplification depends critically on the inclusion proba- bility of the private region, determined jointly by crop size, which should be tuned, and the (fixed) size of the private patch in the dataset. Additional results the effect of image padding are provided in Appendix D.3
9

---

Published in Transactions on Machine Learning Research (03/2026)
5.3 Privacy-Utiie Tradeoffs with Patch-Level Sampling
We conclude our experiments by evaluating whether the amplification provided by patch-level sampling improves model utility under a fixod privacy budget. We consider two widely used segmentation archi- tectures, DeepLabV3+ (Chen et al.] 2018) and PSPNet. (Zhao et al. 2017), each trained two datasets: Cityscapes (Cordts al. 2016) and A2D2 [Geyer et al. 2020). For each model-dataset combination, we compare two variants of DP-SGD: one using standard minibatch subsampling, and one using our proposed patch-level sampling on top. Importantly, both settings use exaclly the same training algorithm; the only difference lies in how privacy is analyzed. This means our method can be "switched on" without altering hyperparameters or implementation, and it will, in principle, always yield at least as much utility, either by allowing more training iterations for the same privacy budget or by requiring less noise meot given budget and epoch number.
To make this comparison fair and controlled, we adopt single fixed hyperparameter configuration across all experiments. This configuration was chosen based on preliminary tuning and then held constant throughout, ensuring consistency across model-dataset pairs. While this sacrifices peak performance in individual cases, it isolates the effect of the privacy analysis itself. Each experiment is repeated with four random seeds, and we report the mean and standard deviation, depicted as error bars in Figure 5 are given in Appendix C.4
Full details of the training
As shown in Figure 5 patch-level sampling consistently yields higher utility for a given privacy-lovel e. On Cityscapes with DeepLabV3+, it improves mean Intersection over Union (mloU) by average of over 40% across the tested range of e, with gains as large as 81% at E z 5. For PSPNet on the same dataset, the advantage is even more pronounced, with an average improvement of over 110% and up to 330% at E = 5. On A2D2, we present results for PSPNet, where patch-level sampling improves mIoU by an average of 18% and up to 23% at e R 5. We observe some variability across random initialization for DP-SGD, particularly with DeepLabV3+ on Cityscapes, which results in partially overlapping error bars between methods; per-seed results are provided in Appendix C.5 Additionally, under our compute constraints, DeepLabV3+ did not consistently converge on A2D2, and we therefore defer detailed discussion of this setting to Appendix C.6)
We also compare with Gaussian noise augmentation from Schuchardt et al. 2025) as an alternative am- plification mechanism in Appendix C.7 it performs worse than both our method and standard minibatch subsampling due to the high imput sensitivity.
Lastly, we evaluate on image classification to show that the amplification effect generalizes beyond segmen- (ation; results are provided in Appendix C.8 Since our method improves privacy accounting rather than training, the benefit is task-agnostic whenever random cropping is part of the pipeline.
Together, these results confirm that patch-level amplification enables substantially more favorable privacy- utility tradeofls, especially in the low-to-moderale privacy budget regime where standard DP-SGD suffers most from noise-induced degradation.
6 Limitations and Future Work
Our work introduces patch-level DP as a way to exploit spatial structure in vision data. While our results demonstrate clear theoretical and empirical advantages over standard minibatch sampling, several limitations remain.
First, our analysis relies on binary treatment of patch intersection: a patch is either included or not, regard- less of the fraction of overlap. This may be conservative when partial overlap truly leaks less information. However, this is fundamental property of DP-SGD: since the gradient is an arbitrary function of the input, we cannot assume that partial visibility leaks less than full visibility. Tighter guarantees could potentially be achieved with additional knowledge about the model, such as Lipschitz continuity of gradients (Das et al. 2023 Béthune et al. 2024), but our focus is on providing a general tool that works for arbitrary models.
Second, we assume that the size of the private patch is fixed and known in advance. If the assumed patch size is larger than the true sensitive region, our guarantees remain valid but become more conservative,
10

---

Published in Transactions on Machine Learning Research (03/2026)
DeepLabV3- on Cityscapes
PSPNet on Cityscapes
0.10
0.35
0.35
0.30
0.30
0.95
0.25
mlou
0.20
0.20
0.15
0.15
0.10
0.10
Patch-Level Subeampling
Pateh-Lexd Subsempling
0.05
Minikatch Subsampling
Minisstch Sulsampling
PSP on A2D2
0.30
mIoU
0.15
0.10
Patch-Lovel Subsampling
Minibatch Suhsampling
20
100
Figure 5: Model performance versus privacy-level for DP-SGD with patch-level sampling (blue) and mini- batch subsampling (orange). Results are averaged over four seeds; error bars show standard deviation. For Cityscapes, we use 8 = 1/2975, and for A2D2, 8 = 1/18557, following å = 1/epoch_stt size. For both datasets a private patch size of 10 x 10 is assumed. DG-SGD with patch-level privacy overperforms significantly, given the exact same setup.
potentially sacrificing some utility. In the limit, if assume the entire image is sensitive, recover minibatch subsampling and standard record-level DP-SGD guarantees. If the assumed patch size is smaller than the true sensitive region, the stated guarantee can be too optimistic. However, this is general limitation in differential privacy, analogous to e.g. assuming record-level privacy when user-level privacy is required. In practice, practitioners should choose conservative upper bound on the sensitive region size based on the amount of domain knowledge they have of their application. Crucially, our analysis dccoupled from the mechanism: given any combination of crop size and private patch size, can compute the corresponding privacy guarantee without modifying training. Developing adaptive strategies for patch size remains open question. One potential direction is detection-based patch modeling using domain-specific detectors (c.g., face or license plate detection), though such detectors must themselves be DP-trained or use public data to preserve guarantees. Importantly, when in doubl, practitioners should conservatively assume larger patch sizes, or in the limit, default to standard record-level DP-SGD, which is always a valid choice.
Finally, our method is applicable when sensitive content is spatially localized and random cropping is a natural part of the training pipeline. This is typically the case for high-resolution images where cropping
11

---

Published in Transactions on Machine Learning Research (03/2026)
improves generalization. Conversely, our method does not apply when cropping is impractical (e.g., low- resolution datasets like MNIST (LeCun et al. 2002) or CIFAR-10 (Krizhevsky et al. 2009) where cropping destroys semantic content; we report the emprical results on MNIST in Appendix C.S), or when crop size approaches image size, climinating any exclusion probability. Many important real-world applications satisfy our requirements, including aulonomous driving, medical imaging, surveillance, and satellite imagery.
Overall, we view these challenges not as drawbacks but as opportunities. Our framework opens the door to more sophisticated treatments of spatial privacy, such as overlap-aware accounting, adaptive private regions, and domain-specifie extensions beyond vision. Exploring these directions could further strengthen the connection between differential privacy and the structured nature of real-world data.
7 Conclusion
In this work, we extended the traditional analysis of DP-SGD by considering patch-level differentiol privacy to better reflect the spatial structure of vision data. We formalized a patch-level neighboring relation and analyzed how random cropping can serve as a privacy amplification mechanism when private information is spatially localized. Our thcorctical results show that the effective sampling rate docomposcs into indo- pendent. image- and patch-level components, generalizing classical amplification bounds. Empirically, we demonstrated that patch-level sampling consistently improves the privacy-utility trade-off across multiple architectures, datasets, and tasks. The approach is fully compatible with existing DP-SGD implementations and introduces no additional computational overhead. More broadly, our findings demonstrate that aligning privacy mechanisms with domain-specific structure and leveraging stochastic elements already present in training pipelines is a powerful approach, enabling the design of learning systems that are simultaneously more private and more accurate.
Acknowledgements
This paper was supported by the DAAD programme Konrad Zuse Schools of Excellence in Artificial Intelli- gence, sponsored by the Federal Ministry of Research, Technology and Space. It was further funded by the German Research Foundation (grant GU 1409/4-1).
References
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Tlya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference Computer and Communications Securily, CCS'16. ACM, October 2016. doi: 01114///977799999755557
Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. Large-scale differentially private bert. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 6481- 6491, 2022.
Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. Advances in neural information processing systems, 31, 2018.
Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy profiles and amplification by subsampling. Journal of Privacy and Confidentiality, 10(1), 2020.
Gilles Barthe and Federico Olmedo. Beyond differential privacy: Composition theorems and relational logic
for f-divergences between probabilistic programs. In International Colloquium on Automata, Languages and Programming, 2013.
Louis Béthune, Thomas Masscna, Thibaut Boissin, Yannick Prudent, Corentin Friodrich, Franck Mamalct, Aurélien Bellet, Mathieu Serrurier, and David Vigouroux. Dp-sgd without clipping: The lipschitz neural network way. In ICLR 2024- 12th International Conference on Learning Representations, 2024.
Seang-Chich Chen, George Papandreou, Florian Schroff, and Hartwig Adam. Rethinking atrous convolution for semantic image segmentation. ArXiu, abs/ / 1506005587 2017.
12

---

Published in Transactions on Machine Learning Research (03/2026)
Liang-Chite Chich Chen, Yukun Zhu, George Papandreou, Florian Schroff, and Hartwig Adam. Encoder-decoder with atrous separable convolution for semantic image segmentation. In European Conference on Computer Vision, 2018
Mircea.
Cimpoi, Subhransu Maji, Tasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3606-3613 2014.
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understand- ing. 2016 TEEE Conference on Computer Vision and Pottern Recognition (CVPR), pages 3213-3225 2016.
Rudrajit Das, Satyen Kale, Zheng Xu, Tong Zhang, and Sujay Sanghavi. Beyond uniform lipschitz condition in differentially private optimization. In International Conference Machine Learning, pages 7066-7101. PMLR, 2023.
Soham De, Leonard Berrada, Jamic Hayes, Samuel L. Smith, and Borja Balle. Unlocking high-accuracy differentially private image classification through scale, 2022. URL htttps:/arziiv.rr///attt wwwp/ba////////.o..///// 13650
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fci. Imagenet: A largo-scale hicrarchical image database. 2009 IEEE Conference on Compuler Vision and Pullern Recognilion, pages 248 255, 2009. doi: 20000//VPR.2000.2066660
Andy Dong, Wei-Ning Chen, and Ayfer Ozgur. Leveraging randomness in model and data partitioning for privacy amplification. In Forty-second International Conference on Machine Learning, 2025.
Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(1):3 37, 2022.
Vadym Doroshenko, Badih Ghazi, Pritish Kamath, Ravi Kumar, and Pasin Manurangsi. Connect the dots: Tighter discrete approximations of privacy loss distributions. Proceediigs on Privacy Enhancing Techmologies, 4:552-570, 2022.
Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine, Kristin E. Lauter, Michael Naehrig, and John Robert Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning, 2016.
Cynthia Dwork. Differential privacy. In International Colloquium on Automata, Languages and Program- ming, 2006.
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Set. 9:211 407, 2014.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryplography conference, pages 265 284. Springer, 2006.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015.
Jakob Geyer, Yohannes Kassahun, Mentar Mahmudi, Xavier Ricou, Rupesh Durgesh, Andrew S Chung, Lorenz Hauswald, Viet Hoang Pham, Maximilian Mühlegg, Sebastian Dorn, et al. A2d2: Audi autonomous driving datasct. arXiv preprint arXiv:2004. Xxx:2200400620, 2020.
Aditya Golatkar, Alessandro Achille, Yu-Xiang Wang, Aaron Roth, Michael Kearns, and Stefano Soatto, Mixed differential privacy in computer vision. 2022 IEEE/CVF Conference on Computer Vision and Pallern Recognilion (CVPR), pages 8366 8376, 2022.
Google Differential Privacy Team. dp accounting library.
https://github: com/ cot.ouoo.ooo/googge/ google/ Ltffereetaaappiaae///eeaaa///aae accouutiingnc..ggggc..n.c.. 2024. Accessed Feb 5, 2025.
13

---

Published in Transactions on Machine Learning Research (03/2026)
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern vecognilion, pages 770-778, 2016.
Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pages 448-456. PMLR, 2015.
Shiva Prasad Kasiviswanathan, Homin K. Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam D. Smith. What can we learn privately? 2008 49th Annual IEEE Symposium on Foundations of Computer Science, pages 531-540, 2008
Antti Koskela, Joonas Jälkö, and Antti Honkela. Computing tight differential privacy guarantees using fft. In International Conference on Artificial Intelligence and Statistics, pages 2560-2569. PMLR, 2020.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alex Krizhovsky, Dya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. Communications of the ACM, 60:84 90, 2012.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. badient-bbasd learning applied docu- ment recognition. Proceedings of the IEFE, 86(11):2278-233) 2002.
Mathias Lécuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel J. Hsu, and Suman Sekhar Jana. Certified robustness to adversarial examples with differential privacy. 2019 IEEE Symposium on Security and Privacy (SP), pages 656-672, 2018.
Daniel Asher Nathan Levy, Ziteng Sun, Kareem Amin, Satyen Kale, Alex Kulesza, Mchryar Mohri, and Ananda Theertha Suresh. Learning with user-level privacy. In Beygelzimer, Y. Dauphin, P. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, 2021.
Ninghui Li, Wahbeh H. Qardaji, and Dong Su. On sampling, anonymization, and differential privacy or, k-anonymization meets differential privacy, In ACM Asia Conference Computer and Communications Security, 2011.
Wan-Yi Yi Lin, Fatemeh Sheikholeslami, Leslie Rice, J Zico Kolter, et al. Certified robustness against physically- realizable patch attack via randomized cropping. 2021.
Bo Liu, Ming Ding, Hanyu Xue, Tianqing Zhu, Dayong Ye, Li Song, and Wanlei Zhou. Dp-image: Differential privacy for image data in feature space. ArXie, abs/2103.0rs 07077,,, 2021.
Ryan McKenna, Yangsibo Huang, Amer Sinha, Borja Balle, Zachary Charles, Christopher A. Choquette- Choo, Badih Ghazi, Georgios Kaissis, Ravi Kumar, Ruibo Liu, Da Yu, and Chiyuan Zhang, Scaling laws for differentially private language models. In Forty-second International Conference on Machine Learning, 2025.
Richard McPherson, R. Shokri, and Vitaly Shmatikov. Defeating image obfuscation with deep learning. ArXio, abs/ 1609.00408, 2016.
Sebastian Meiser and Esfandiar Mohammadi. Tight on budget? tight bounds for r-fold approximate differ- ential privacy. In Proceedings of the 2018 ACM SIGSAC Conference Computer and Communications Security, CCS '18, page 247 264, New York, NY, USA, 2018. Association for Computing Machinery. ISBN 9781450356930. doi: 00.1145/3243734..2
URL https://doii org/10. 1145/3243734. 32437665
Seong Joon Oh, Rodrigo Benenson, Mario Fritz, and Bernt Schiele. Faceless person recognition: Privacy implications in social media. In European Conference on Computer Vision, pages 19-35. Springer, 2016.
Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta. How to dp-fy ml: A practical guide machine learning with differential privacy. Journal of Artificial Intelligence Research, 77:1113-122 1201, 2023.
14

---

Published in Transactions on Machine Learning Research (03/2026)
Tom Sander, Pierre Stock, and Alexandre Sablayrolles. Tan without burn: Scaling laws of dp-sgd. In International Conference on Machine Learning, 2022.
Jan Schuchardt, Mina Dalirrooyfard, Jed Guzelkabaagac, Anderson Schneider, Yuriy Nevmyvaka, and Stephan Günnemann. Privacy amplification by structured subsampling for deep differentially private time series forecasting. In Forty-second International Conference Machine Learning, 2025.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov, Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEEE, 2017.
Connor Shorten and Taghi M. Khoshgoftaar. A survey on image data augmentation for deep learning. Journal of Big Dala, 6:1 6:1-48, 2019.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition, 2015. URL btttps://arxiv.org///// 140.//119..100 1556
David M. Sommer, Sebastian Meiser, and Esfandiar Mohammadi. Privacy loss classes: The central limit theorem in differential privacy. volume 2019, pages 245 269, Berlin, 2019. De Gruyter. doi: 10.3929/ cthz-b-000359450. 19th Privacy Enhancing Technologies Symposium (PETS 2019); Conference Location: Stockholm, Sweden; Conference Date: July 16 20, 2019.
Shuang Song, Kamalika Chaudhuri, and Anand D. Sarwate. Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference on Signal and Information Processing, pages 245 245, 2013. doi: 10.1109/ D..1099GlobalSTP... (eabbalSTPP2013667335
Qianru Sun, Liqian Ma, Seong Joon Oh, Luc Van Gool, Bernt Schiele, and Mario Fritz. Natural and effective obfuscation by head inpainting. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5050-5059, 2017.
Jonathan Ullman. Cs7880: Rigorous approaches to data privacy. https://www. ccs. nww.nuu.uee..e..ee..uuu..uu..... www.euu.uuuuuue.eeee edu/home/ jullman/cs788n http/////00001//11111..... pdf 2017. Course Notes, Northeastern University.
Salil P. Vadhan. The complexity of differential privacy. In Tutorials on the Foundations of Cryptography, 2017.
Yifan Wu, Fan Yang, Yong Xu, and Haibin Ling. Privacy-roteective-aa for privacy preserving face de- identification. Journal of Computer Science and Technology, 34:47 60, 2019.
Ashkan Yousefpour, Tgor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and llya Mironov. Opa- cus: User-frrinddi differential privacy library in pytorch, 2022. URL https://arxiv.. http:://aardd.or//ab///0000/ arg/abs/2109.
12298
Hengshuang Zhao, Jianping Shi, Xiaojuan Qi, Xiaogang Wang, and Jiaya Jia. Pyramid scene parsing network. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2881-2890, 2017.
Yuqing Zhu, Jinshuo Dong, and Yu-Xiang Wang. Optimal accounting of differential privacy via characteristic function. In International Conference on Artificial Intelligence and Statistics, pages 2022.
PMLR,
Daniel Zügner, Johannes Gasteiger, Nicholas Gao, and Dominik Fuchsgruber. SEML: Slurm Experiment Management Library, 2023. URL https: https://github. wtatttub.ccmm//n-DDM////eeee
15

---

Published in Transactions on Machine Learning Research (03/2026)
A Comparison of Patch-Level and Record-Level Privacy
The choice of neighboring relation is a fundamental modeling decision in differential privacy. In the vision domain, standard record-level privacy (Dwork et al., 2006; Dwork 2006) assumes each image is a record, and changing a single altribute of record treated identically to changing all altribules. This is because it is assumed that the gradient is an arbitrary function of the input, and the only information available for privacy accounting is the clipping norm. We cannot assume that small input changes yicld small gradient changes. So changing single pixel in an image constilutes adjacency.
However, record-level privacy can be overly pessimistic when sensitive content is spatially localized. This is analogous to the distinction between uscr-level (Levy et al. 2021 and record-level privacy. In user- level privacy, neighboring datasets differ in all records belonging to a single user, whereas in record-level privacy, they differ only a single record. User-level provides stronger protection but is more conservative; record-level is finer-grained and yields tighter guarantees when each user contributes exactly one record.
Our method extends this hierarchy by exploiting the spatial structure of vision data, introducing patch-level privacy as finer-grained notion when sensitive content is localized. Patch-level DP is appropriate when privacy-sensitive information is confined to spatial regions whose size can be estimated or (conservatively) bounded. Typical examples include faces in photographs, license plates in traffic scenes, or lesions in medical imaging.
Thus, our work can be interpreted as weakening the worst-case assumption of record-level DP: instead of assuming the entire image may change, we assume only a bounded region may change (patch-level). Analogous to record-level privacy, a single pixel change in the private patch constitutes adjacency. When the domain structure supports this assumption, tighter guarantees follow.
In contrast, when the location of sensitive content cannot be bounded, record-level privacy should be used. Importantly, our method gracefully handles this case: as the private patch size approaches the full image size, patch-level privacy naturally converges to record-level privacy with minibatch subsampling (see Figure
Finally, it is important to consider that coarser-grained relations always imply finer-grained ones: standard record-level privacy guarantees automatically provide patch-level privacy, since any patch substitution is a special case of record substitution. Standard record-level privacy is always a valid and conservative choice when no such assumptions can be safely made.
B Proofs of patch-level privacy
B.1 Proof of Lemma
Let the original image have width W, and height H,, and let the crop have width We and height He. Padding is applied symmotrically with pad, pixels horizontally and pad, pixcls vertically. After padding, the number of valid horizontal and vertical crop origins are Win W1 + 2pad, +1, Hos H, + 2pad, -H + 1, as images form discrete space by virtue of their pixel structure. The total number of possible positions of the crop [S2] can be written as the total area Atoo = Wrot Hoot
Let R C NG be a fixed rectangular patch in the original image with bottom-left coordinate (Rg, and size Hn x WR. After padding, its bottom-left. coordinate becomes R. = R₂ + pady; R' = Ry + pady-
A crop region Cu,u of size He We intersects R with a minimum of a single pixel if and only if its origin [Ymin Mmax], where
(u, v) satisfies u E [Xmin; Xmax],
Xmin = max (0, Ry, - Wo + 1),
Xmax = min (W, + 2pad. - Wc, R² + WR - 1), Ymax min (II, + 2pady Ho. R2 + HR - 1),
Ymin = max (0, R' Hc + 1),
as the image boundaries roist the valid horizontal and vertical placements of the crop origin relative to the padded patch.
The number of crop origins that intersect R, meaning jRxl, can be written as the favorable area Agv (Xmax- X +1) (Y max Ymin + 1). As define the random cropping as a uniform distribution (Definition
16

---

Published in Transactions on Machine Learning Research (03/2026)
all crop origins are equally likely. Thus, the patch-level inclusion probability is
Asav
(X X Xmi + 1)(Y)aa Ymmn + 1) (W, 2pad, Wc + 1)(H, + 2pad, Hc 1)
Crro R))
Atot
B.2 Proof of Theorem 1
Given Verop ()) from Lemma we want to maximize the patch-level inclusion probability. The denominator is constant, so it suffices to maximize (R) := (Xmax Xmin +1 (Y max - Ymm + 1). As defined previously, the horizontal factor Xmax - min + equals min(W, + 2 pad_ Wc, R² + WR 1) max((0, R2 We + 1)+1, a function R₂ only. Consider four cases:
Left-bound only. If R2 -WC+ Woct<o and R WR S W, pad, Wc, then
Xumx Xuin + += RR' WR 1)
R + Wn.
which is strictly increasing in R2 for R2 S WT pad - We W R + Moving the patch to the right linearly increases the horizontal contribution.
Right-bound only. If Rd Wc + 1 1 and R' WR W + 2pdd We, then
Xmax Xmin +1= (Wr + 2 2pd, Wc) (R² We + 1) +1= W, + 22ad, R
which is strictly decreasing in R2 for R2 We 1. Moving the patch to the left linearly increases the horizontal contribution.
Fully contained. If R - We +1 and R + WR - W, + 2add - Wc, then
Xmax Xmin + = (R2 + WR 1) (R'2 Wc + 1) + 11 WR Wc 1,
which is constant in R2 for Wc - 1 R2 < W + 2 pad_ - We WR +1 Any horizontal shift within this range leaves the horizontal contribution unchanged at its maximum value.
Both bounds active. If R We +1+1 and R. + WR - > W, + 2pad, - We, which can occur only if W1 + 2 pad,- < 2Wc + WR 2, then
Xmax Xmin + (Wr + pad, Wc) - - WT + 2pdd Wc
which is constant in R for all positions satisfying the incqualities above. In this regime, every admissible horizontal placement achieves the largest possible horizontal value, and the maximizer is determined solely by the vertical factor.
From the four regimes above, conclude that only (1) in the bound regime, shifting R right increases the horizontal factor until the left bound is inactive. (2) In the right-bound only regime, shifting R left increases the horizontal factor until the right bound is inactive.
(3) Once both bounds are inactive (fully contained), the horizontal factor is constant at its maximum possible value within unclipped regimes. (4) In the case that both bounds are active, the horizontal factor attains its absolute maximum and is independent of R In all cases, the horizontal factor maximized when the patch positioned as far from both borders as possible. When the width allows an unclipped regime, placing the patch in the middle ensures it lies in that regime; the same holds in the special case where both bounds active. In edge cases where constant regime exists, every admissible position already achieves the maximum.
By symmetry, the vertical factor is optimized by the same reasoning, placing R centrally along the vertical axis. Combining both axes yields the centrally placed patch, whose coordinates in the original image are
H1 |H-HHH H (1
Wi WR
Reenter =
2
which maximizes Yrrop (R)-
17

---

Published in Transactions on Machine Learning Research (03/2026)
B.3 Proof of Theorem 2
In the following, we derive the dominating pair for patch-level subsampled mechanism M Serop o Swo where M X' RD an arbitrary mechanism, i.c., (x) is distribution over co-domain RD given a (subsampled) dataset E X.
To characterize the output distribution of the patch-level subsampled mechanism, first observe that cropping and datasct-level subsampling commute, meaning we can first sample random crop for each image and then select a subset of images. Thus, the distribution for specific batch can be fully characterized by dataset x (x1....,,a' the subset of selected indices J S [n], and the sequence of selected crop origins Ω2" With a slight abuse of notation, we denote this distribution as M J... Thus, for a batch size m, the overall patch-level subsampled distribution
(Mo ScrOp (z)
Σ I[(m]]]]]=
Σ oef
1
" M ((r..o)).
(4)
In the following, we consider w.l.o.g. patch-level neighboring dataset x' aa.p which differ within some worst-case patch R within the nth image, i.e., x' (f1, ....,,,........... x/) Under this assumption, we can separate out parts of the subsampling distribution that identical between a and a', and those that dissimilar: We observe that the generalive process defined by 4 is equivalent to
1. sampling crop origins o-n E Q2"1 for the first n 1 images
sampling uniformly at random a subset J-n of size m an arbitrary
S [n - 1]] from the first n images and
and then either
(a) with probability 1 Two, sampling uniformly at random an index [n - 1] \ J to include in the batch and selecting an arbitrary nih crop origin
(b) with probability (w - Yerop (Rt), including the nth image in the batch and sampling uniformly at random a crop origin On,-R E Q_ that does not intersect with R
(c) with probability Yeop (R), including the nth image in the batch and sampling uniformly at random a crop origin On. E U2 that intersocts with
Thus, we can restate Eq.
as
Σ
(m-1)²
m n-
Σ
1
Σ
Σ
Σ
|0
m
P- 14
==
o -
aE(n- 1]V
on.-Re -.. on, R
(wo7w) (x, U {a). (o-n; On))
+ (1- Yeop (R)) M (x, Jn U [n), (o-ns On,-R)
+ Yeop (R) M ( J_n U (n), (o-n, (o_n)
For neighboring dataset x' 2A we can restate (M gerop o Swo (x') in an analogous manner by replacing every occurrence of with z'. Since both mixture distributions share identical mixture weights, the following rosult follows immediately from the joint convexity (Balle et al. 2020 and thus joint quasi-convexiity of hockey-slick divergence Ha:
Lemma 2.
The patch-level subsampled mechanism (M c Scrop (we) is dominated by the three-compoment misture mechanism
M(x) = (1- Tmo) MM Yoo (1- (B) + Two (R) (R)
(5)
2Te selected origins chosen sequence define correspandence between crops and images.
18

---

Published in Transactions on Machine Learning Research (03/2026)
with misture components
Mz) = M(z,J_n (o 0n)) Mn,-R(a) = - U (n), (o-n; 0z, (n,n(x) = M( U [m), (o-n: 0n.R)
for some indez [n 1], and some crop origns On Q2 On S-- and On,-R E QR.
More simply stated, M-n refers the the mechanism for a specific subset of indices in which the nth image is not included. Next, MR is the mechanism for specific batch in which the nth image is included but the private region R is not in the crop. Finally, Mn, is the mechanism for subsct of indices in which the nth image is included and the private region R is in the crop. Overall, Lemma 2 lets us reduce the analysis of our -ighsiimensional mixture mechanism to mixture mechanism with just three components.
In the following, we will derive privacy guarantees for this simplifiod mochanism in terms of dominating pairs of the underlying mechanism M X' - DRD, beginning with a 2 and then proceeding S a <
Case 1: a For our proof, will expand upon the following "advanced joint convexity" property (Balle et al. 2018); which allows for a simplified analysis of two-component mixtures where the first component, is identical.
Lemma 3 (Advanced joint convexity). Let P = (1 P1 + and Q= (1-11m))) n) + be two mixture distributions with Pi = Qi and some j0, 1]. Given 2 1, let a' = -aa-1) + and B = a'. Then the following holds:
H. (P(Q))) =
3) 3Q2).
Specifically, the advanced joint convexity property can also be used to analyze three-component mixtures, where the first three components are identical, which is the case when applying M from Eq. to and x':
Lemma 4. Let P m P1 P2 + T3P3 and m n1Qi= 12Q2 + 17Q3 be two mirture distributions with Pi Q1, P2 Q2 and some n [0, 1|s with ||m [1 1. Given 1, let a' (a- 1) + and 3 a'. Then, the following holds:
(PlIQ) S na max (H. H. (BP
H. (P
Proof. The distributions P and Q can be trivially reformulated as
?h
122
P (71 112)
P1
+
P2
n3p33
1/1 + 7/2
1/1 + 172
Q (m 12)
!71
Q1
1/2
Q2
n3Q2.
111 + 7/2
171 + 172
Using Pi Q1 and P3 = Q2 and applying Lemma then shows
(PIlQ) = Ha. (Pal(11 (1-11-1) 3)
171
P 7n
722
P2
+ (Q2..
7/2
+
722
The result then follows from quasi-convexityy of the hockey stick divergence in the space of measures.
Combining 2 and 4 can complete our analysis for 2 1:
Lemma 5. Let M be mechanism that is dominated by P,Q under the substitution relation = Let Swo denole without- replauet-eellacmmend subsampling of minibalch size and gerop the random cropping mechanism we defined in Definition 5. Then, under the patch-level substitution relation ~A the composed mechanism M o gcrop Swo satisfiss
MMoorropSSr w (a) S Ho ((1 - Yoff) ) + 7eft Q)
(6)
for any a 2 1.
19

---

Published in Transactions on Machine Learning Research (03/2026)
Proof. Consider an arbitrary pair of datasets aA xf that differ in arbitrary patch R. From it immediately follows that
2 and
Ho ((M Scrpp o SS 5m) (2)](( o Strp o sm))
Swoo Verop (R) max {Har
(z), Ho (M,,, Har (M (Mu.
with a'= (a /
(Nwo ((rup()) +1
It is casy to see that in all three cases, the batches operated on by both mechanisms only differ by single substitution:
1. (z) is equivalent to (x,)( after removing the cropped z from the batch and replacing it with some Va-
(n))((F) is equivalent to Mn, x(x') after replacing the cropped aa with differently cropped on- (I) equivalent Mnr)(()) after replacing the cropped s with an identically cropped In-
It thus follows that
H. Ha((M o Serop o Sm) (=))(M Stro (m))( S Two Yarop (R) - (aI())
Next, we observe that this term is maximized by patch that maximizes the intersection probability, i.c., arg max Verop((f) (Rt). This is because a' is monotonically decreasing in and Ha is itself monotonically decreasing in a'. After substituting Ysub maxx (R) with Veff, the final step to apply advanced joint convexity in reverse order with =a/ a':
Nef Hal(Pl)Q) = Jeft Ha - -)0 3Q) Ha Tea) )Q + Vell PII(1 - + +2))
Substituting (1-7)Q+ + 7Q = Q concludes our proof.
Case 2:
1 The proof for this case largely follows the final steps of the proof of Proposition 30 in Zhu
et al. 2022 We will use the following Lemma, which corresponds to Lemma 31 from (Zhu et al. 2022
Lemma 6. Let M be a mechanism and a symmetric neighboring relation. Then
(P.Q) is a dominating pair of M, then (Q.P) is also a dominating pair of M
The following two statements are equivalent:
(a) sup H. (=))) < H.(P([Q) for all 2 1.
(b) sup Ha (M(())))IM(E)) H.(QIP)) for all 1.
We can use the first part of Lemma to conduct exactly the same proof as for but interchange all occurrences of P and Q The following result then immediately follows from the second part of Lemma G
Lemma 7. Let M be a mechanism that is dominated by P. P,Q under the substitution relation ~ Let Swo denote witphent-replacement subsampling of minibatch size m and Scrop the random cropping mechanism from Definition 5 Then, under the potch-level substitution relation = AAp, the composed mechanism Mo Scrop S swn satisfies
Moo (a) < Ha (P [] Yoo + Yea Q)
(7)
for any 0 5 a I
Combined with Lemma 5 this concludes proof of Theorem 2.
20

---

Published in Transactions on Machine Learning Research (03/2026)
B.4 Tightness of Theorem 2 for DP-SGD
In the following, prove that Eq 3 holds with equality for noisy, clipped gradienl updates for some worst- case model.
Consider an arbitrary differentiable model : + y that maps a single eropped image to a single prediction from some co-domain V. Assume that the model has E N parameters. Let g IC - RD be the function that maps a single cropped image the parameter gradients under some loss function. Like in Abadi et al. (2016), can then define our differentially private gradient mechanism M 2 + as
M(Z)
1
Σ LEEZ
|Z|
where Clip(a(=), k) scales the gradient to maximum norm of K E I.+.
Mechanism M is simply a Gaussian mechanism with & sensitivity 2 under substitution relation =a (note that the covariance is scaled by x²). Thus, analogous to Proposition 4 is dominated by univariate Gaussians (NO,, o) and (22, a). Due to translation invariance of hockey-stick divergences between Gaussians, it also dominated by P = = and Q = o)),
To show that it is tightly dominated by P.Q under the standard substitution relation, and since we do not have any additional information about gradients or model S, consider a worst-case Ic - TRD with g(2) [c 0-.-0]" if the value appears in the input cropped image and g(2) [-x 0..-0) ... otherwise.
For this specific 9 define the cropped batches Z {21, 22, and Z' = {21, 22, ................................ zxy where 2 has
value i in every pixel and z' has value O in every pixel. Then,
sup H((M(Z))((()) (H - nkRI, x² 1202 1)ke + txe, x2²1) z~a7!
-H.(N(- KO) (W, -H,(W(-1,o))WLL..)))
(8)
This lower bound for the non-subsampled base mechanism coincides with the upper bound given by the privacy profile of dominating pair P, Q.
applying minibatch subsampling and cropping to mechanism M to construct M : 2 + RDD yields a privacy-profile upper-bounded by
As per Theorem 2
Ha ((1 (e + Yea P([ if 1,
MMSstroossw (a) E
(9)
Ha (P (1- P Qen f0
In the following, we construct a worst-case dataset for each a 2 1 such that the previously constructed gradient function g has privacy profile that exactly matches this upper bound.
Case 1: 0 S < Define the original dataset of images X 12, has value i everywhere. Define the patch-level substituted datasct of images X' ~A, that is identical to X everywhere, except for all pixels of on in worst-case patch from Theorem [ being replaced by 0. By construction, the gradient function is only ever applied to cropped images that do not contain 0 and thus only ever returns 9(=) = [-x 0 0".. When operating on X', the gradient function is applied to cropped image containing value 0 with probability ? Terops in which case it returns g(2) [R 0-...0"
22. .2....... Fn
where the ith image
Thus, and by using the translation and scale invariance of hockey-stick divergences between Gaussians in the same manner as in Eq. g
MoSeropa Swo (ax) H.((((1,,))]C) "Trop -N(11, + Verop -N(1o))),
which matches Eq 9
21

---

Published in Transactions on Machine Learning Research (03/2026)
Case 2: 1
The proof is fully analogous, one just needs to exchange the constructed X and X'.
C Experimental Setup
In Section 5 we described the main experiments and their results. Here, we provide the detailed configura- tions and discussion to ensure reproducibility and to clarify the precise conditions under which our results were obtained.
C.1 Datasets
We evaluate Cityscapes (Cordts et al. 2016) and A2D2 (Geyer et al. 2020). Cityscapes contains 5000 fincly annotated street-scene images at 1024 x 2048 resolution with 2975/500 500 train/ vran/vval split; since the official Lest labels are unavailable, we report on the validation set. A2D2 consists of 33,441 driving-scene images at 1208 x 1920, annotated for 18 classes (grouped from 38 original classes to create a Cityscapes- like taxonomy), and we use session-based split with 11 training sessions, 3 validation sessions, and 3 test sessions.
C.2 Models
We use DeepLabv3+ Chen et al. 2018 and PSPNet (Zaoo et al. 2017). For compatibility with DP-SGD, we disabled batch normalization layers in both architectures, as batch normalization relies on batch-level statistios, which are incompatible with privacy guarantees under DP training. Backbones are initialized from ImageNet (Deng et al.) 2009); segmentation heads are randomly initialized. We fine-tune the entire model end-to-end.
C.3 Differential Privacy Setup
Differential privacy is implemented with Opacus' Youselpour et al, 2022
DPOptimizer and accounted
with privacy loss distribution (PLD) composition (Dong et al. 2022 Sommer et al. 2019) using the Google
dp_ ao_accuunting library (Google Differential Privacy Team 2024). Minibatches are sampled uniformly with-
out replacement via DPDataLoader. Gradients are clipped at per-sample lg norm. is set to 1/epoch_size We quantize PL.ss using the "connect-che-dous" algorithm DDroshenko el al. 2022).
C.4 Per-Exxeriment Configurations
Mechanism-Speeifee Privacy Profiles. We compare three mechanisms: (1) standard DP-SGD with minibatch subsampling, (2) patch-level subsampling applied on top of minibatching, and (3) noise-addition baseline. The default setup uses image size 1000 x 1000, padding 0, clip norm 2.0, batch size 100, epoch size 3000, and number of epochs 100. Crop and patch sizes, as well as noise multipliers, are varied depending on the specific experiment (sce Appendix D.1. We report 5 as a function of E.
Influence of Crop and Patch Size. We fix the same defaults as above and additionally d
1/ //epoch_aee size and epoch_ size 105. We perform two sweeps. First, we vary the crop side length from 50 to 700 pixels while keeping the private patch size fixed at 10 10. Second, fix the crop size at 450 x 450 and vary the patch size from 1 to 50. We report in both setups.
Privacy-Utility Tradeoffs. Following prior work (Ponomareva et al. 2023 Sander et al. 2022 De et al.
2022 McKenna et al.) 2025), which emphasizes the strong dependence of DP-SGD performance on hyper- parameters, we first conducted a tuning stage on Cityscapes with DeepTabbV3.. The goal was to maximize utility at fixed privacy budget of 10 with 1/2975 and private patch size 10 10. This yielded configuration with crop size 505 505, zero padding, batch size 200 (accumulated from microbatches of size 2 via Opacus' BatcchNemoryManager), clipping norm C 2.0, learning rate 0.02, and training horizon of 100 epochs. We then fixed these hyperparameters across all subsequent experiments, including different
DeeplabV3+ implemented based on the repository http:://ttthaaoo///aaaa//aaaaaaa
22

---

Published in Transactions on Machine Learning Research (03/2026)
models and datasets, to ensure comparability and to isolate the effect of the privacy analysis. For A2D2, the only modification was reducing the training horizon to 25 epochs due to computational limits, with = 1/18,557. For experiments spanning different privacy budgets, we kept the training horizon constant (100 epochs on Cityscapes, 25 on A2D2) and used dp_ ap_accounting (Google Differential Privacy Team 2024 library to compute the Gaussian noise multiplier a corresponding to each largel & (ranging from 5 100). This guarantecs that results are reported under consistent training conditions, with a adapted match the specified privacy-level. All experiments were repeated with four random seeds; we report the mean and standard deviation of the mean Interseciion-ver--Ue Union (mloU). We managed these experiments with seml Zügner et al. 2023).
0.4
0.4
0.3
mloU
mloU
0.2
0.2
Patch-Level Subsumphing
Patch-Lese Subsampling
Minibeteh Subsampling
Minibatch Subsampling
0
60
80
100
60
80
(a) Seed 10
(b) Seed 20
0.4
0.3
0.3
InleU
mloU
0.2
0.2
0.1
Pateh-Level Subsampling
0.1
Patch-Leve Subsampling
Minibatchh Subsampling
Minilatch Sahsampling
0
20
40
60
80
100
0
20
60
80
100
(c) Seed 30
(d) Seed 516
Figure 6: Per-seed privacy-utiligy tradeoffs of DeepLabV3+ on Cityscapes. We assume private patch size of 10 x 10, and set 5 = 1 1/2975.
C.5 Per-Seed Results for Privacy-Utility Tradeoffs
To further examine the high variability in the results of Figure 5] report per-seed results for model dataset combinations in Figures & These plots explicitly illustrate the variability across random initializations that is characteristic of DP- training, as we mentioned in Appendix C.4 On Cityscapes with DeepLab V3+, this variability explains the overlapping error bars noted in the main text. In one seed, for = 70, the baseline briefly exceeds the pateh-level sampling variant at a single privacy level, while the reverse holds across all other values and all remaining seeds. This behavior is typical as the performance of DP-SGD is highly parameter dependent, and the fixed hyperparameter configuration is optimized for high peak performance
23

---

Published in Transactions on Machine Learning Research (03/2026)
rather than reduced variance. Across all seeds, patch-level sampling consistently achieves higher mean utility, which is what is reflected in the aggregated results shown in Figure
0.4
0.3
mloU
0.2
0.2
0.1
Patch-Level Subsampling Mitibtth Suteampling
0.1
Patch Level Subsampling
Minibatch Sabsampling
0
20
40
GO
80
100
0
20
40
60
80
100
(a) Seed 10
(b) Seed 20
0.4
0.25
0.20
ulol
mloU
0.2
0.15
0.10
Patch-Level Subsumpling
Patch-Leve Subsampling
Minibatch Subeampling
0.05
Minihatch Subsampling
0
20
40
60
80
100
20
40
60
80
100
(c) Seed 30
(d) Seed 516
Figure 7: Per-seed privacy-utility tradeoffs of PSPNet Cityscapes. We assume private patch size of 10 x 10, and set 8 = 1/2975.
C.6 Convergence for A2D2 with DeepLabV3+
We attempted training DeepLabV3+ on A2D2 under the fixed hyperparameter configuration described above. Unlike the other model-dataset combinations, however, this configuration did not consistently con- verge. Out of four random seeds, three produced stable training and yielded results consistent with our main conclusions, while one failed to make progress (see Figure g
Importantly, the same instability was also observed for the baseline method with standard minibatch sub- sampling. Thus, while we cannot make conclusive comparisons between the two sampling strategies this setting, the divergence not inherent patch-level subsampling. Instoad, we attribute it a combination of (1) the reduced training horizon of 25 epochs imposed by dataset size and computational constraints, and (2) the lack of dataset-specific hyperparameter tuning. Given the sensitivity of DP-SGD training to hyperparameters (Ponomareva et al. 2023 Sander et al. 2022 De et al. 2022 McKenna et al. 2025). it is likely that adjustments (e.g., learning rate schedules or longer training) would resolve this issue, but such tuning was not. feasible under our compute budget.
Figure 10 shows the per-sood results. While one run diverges, the remaining three clearly demonstrate the same utility gains from patch-level subsampling that we observe in the other settings. This suggests that the lack of convergence is a practical artifact of limited resources rather than limitation of the method itself.
24

---

Published in Transactions on Machine Learning Research (03/2026)
0.30
0.25
0.25
uloU
0.20
mloU
0.20
0.13
0.15
0.10
0.10
Patch--Tevll Subsampling Minibeteh Subsampling
Pairh-Leve Subsampling
0.03
Minibatch Subsampling
0.05
100
100
(a) Seed 10
(b) Seed 20
0.30
0.30
0.25
InleU
0.20
mloU
0.20
0.15
0.15
0.10
0.10
Pateh-Level Subsampling
Patch-Level Saheampling
Minibarchh Subeampling
0.05
Minibatch Subsampling
0.05
20
40
60
80
100
20
40
60
80
100
(c) Seed 30
(d) Seed 516
Figure 8: Per-seed privacy-utility tradeoffs of PSPNet on A2D2. We assume a private patch size of 10 x 10, and set 5 = 1/18557.
C.7 Comparison with Gaussian Noise Augmentation
In the following, we compare our patch-level privacy amplification with Gaussian noise augmentation as an alternative amplification mechanism, following the analysis of Schuchardt et al. 2025 In this setup, Gaussian noise added to images during training, and the resulting amplification is accounted for via TVD- basod composition with minibatch subsampling. We calibrate the noise level to match the same target & values our other experiments. Figures [ad shows results for DeepLabV3+ and PSPNet on Cityscapes and A2D2. Gaussian noise augmentation performs worse than both our method and standard minibatch subsampling. This is because the l sensitivity of the input is large, achieving meaningful amplification via TVD would require impractically high noise levels. When we instead calibrate the noise to match our larget 8 values, the resulting amplification on top of minibatch subsampling is negligible, while the added noise still degrades model performance. This makes the model perform even worse than the minibatch subsampling bascline. In contrast, our patch-level analysis leverages the inherent randomness of cropping, which is already part of standard training pipelines and does not introduce additional perturbations to the input.
25

---

Published in Transactions on Machine Learning Research (03/2026)
DeepLab V3+ on A2D2
mloU
0.2
0.1
Patch-Levvel Suheampling
Minibatch Subeampling
0
20
40
60
80
100
Figure 9: Privacy-utility tradeoff on A2D2 with DeepLabV3+. Results averaged over four seeds, with error
bars indicating standard deviation. We assume a private patch size of 10 x 10, and set = 1/18557.
C.8
Classification Experiments
In addition segmentation, we evaluate our method on the image classification task, as mentioned in Scction 5.3 In the following, we provide detailed results and discussion.
Datasets and Models. We train ResNet-18 (He et al. 2016 and VGG-11 (Simonyan and Zisserman 2015 on DTD CCimpoi et al.) 2014) and MNIST (LeCun et al. 2002) datasets. DTD dataset has 5640 images of different sizes, with a 1880/ 1880/1880/ 1880 train/ train/val/Lest val/Lest. split. To belter align with our method, we drop out the images that have any dimension smaller than 300 and resize the rest to 300 x 300 as preprocessing, This transforms the data split to 1879/1878// 11800. MNIST has a 60,000/10, 11111000010,00000 train/val/tes split consisting of 28 28 images. For both models, on DTD, we freeze the batch normalization layers (loffe and Szegedy 2015) because they incompatible with DP-SGD, as mentioned before. Additionally, initialize the models with ImageNet (Deng al. 2009) weights, then fine-tune the entire model. On MNIST, we remove the batch normalization layers and initialize randomly.
Experimental Setup. For differential privacy, we use the same setup from Section C.3 For hyperparameter configuration, we performed separate tuning for each eetasct-model combination. For the DTD dataset, we assumned private patch size of x 5, smaller relative to A2D2 and Cityscapes, as the image sizes are much smaller. All tuning was done with fixed
10 and used for all epsilon values. For ResNet-18 on DTD (8 1/1879), the optimal configuration was crop size 100 x 100, zero padding, batch size 128, clipping norm C = 0.5, learning rate 0.01, and 150 epochs. For VGG-11 rate to 0.002, and added weight decay 10-1, while keeping the rest the same. Unlike the segmentation experiments, we used SGD with momenturn 0.9 and a cosine learning rate scheduler for both models. For experiments across privacy budgets, we kept training horizons fixed and adapted the noise multiplier o accordingly. All DTD experiments were repeated with four seeds.
DTD, changed batch size to 64, learning
Limitations with MNIST. We additionally experimented with MNIST to explore the boundaries of our method's applicability. We used crop size of 10 10 and assumed private patch size of only pixel, images are much smaller compared to other datasets. However, MNIST presents fundamental challenge: cropping destroys semantic content regardless of privacy considerations. At 28 x 28 resolution, digits contain minimal redundancy, and random crops can make classes not understandable or indistinguishable. For example, cropping "8" can produce shapes similar to "0', '3' or "9". As shown in Table [ even without privacy noise (a = oo), cropping reduces accuracy from over 99% to below 26%. This confirms that our method unsuitable for datasets where global structure is essential for classification and random cropping fundamentally alters class identity. We include MNIST results to delineate when patch-level privacy analysis
26

---

Published in Transactions on Machine Learning Research (03/2026)
0.4
0.35
0.30
0.3
0.25
mloU
mloU
0.20
0.2
0.15
Patch-LLes Level Subeampling
Patch-Levet Subsampling
0.1
Minibatch Subsampling
Mitibatch Subsampling
0.05
20
40
60
80
100
20
40
60
80
100
(a) Seed 10
(b) Seed 20
0.40
0.35
0.35
0.25
mIoU
0.25
0.20
0.20
0.15
0.15
Patch-Lewe Subsampling
Patch Level Subsempling
0.10
Minibatch Subeamphing
0.10
Minihateh Subsampling
60
100
80
100
(c) Seed 30
(d) Seed 516
Figure 10: Per-seed privacy-utility tradeoffs for A2D2 with DeepLabV3+. Three seeds converge and confirm the utility benefits of patch-level subsampling. Seed 516 diverged under both patch-level and minibatch subsampling. We assume a private patch size of 10 10, and set 8 = 1/18557.
is not appropriate: namely, when the task requires holistic image understanding and cropping cannot preserve semantic content. For MNIST, removed batch normalization layers entirely and trained from random initialization.
Table 1: MNIST accuracy without differential privacy (e = oo). Cropping alone destroys utility.
Model
No Crop
Crop (10 x 10)
ResNet-18
99.4%
26.0%
VGG-11 99.2%
16.7%
Results on DTD. Figure shows privacy-utility tradeoffs for VGG-11 and ResNet-18 on DTD. Consistent with our segmentation experiments, patch-level sampling yiclds higher accuracy across all tested privacy budgets. For both models, the improvement becomes more pronounced smaller values, with the largest gains observed in the low to moderate privacy regime. At s = 1, however, the difference diminishes as the high noise magnitude degrades training for both methods. Per-sced results are provided in Figure 15 and
16
As anticipated, both methods perform poorly on MNIST due to the cropping induced information loss discussed above. Table | shows that random cropping alone, even without differential privacy, reduces accuracy from over 99% below 27%, confirming that cropping destroys class-discring discriminative information for MNIST. Since cropping already fails in the non-private setting, applying DP-SGD on top of
Results on MNIST.
27

---

Published in Transactions on Machine Learning Research (03/2026)
DeepLabV3- on Cityscapes
PSPNet on Cityscapes
0.10
0.35
0.35
0.25
0.20
mloU
0.20
0.20
0.15
0.15
0.10
Patch-Level Subsampling
Patch-Level Suhsampling
0.05
Minibsteh Subsempling
0.05
Minibatel: Subeampling
Gaussian Noise Augmentation
Gaussian Noise Augmeulation
0.00
0.00
Figure 11: Privacy-utilityy tradeoff comparing patch-level subsampling (blue), minibatch subsampling (or- ange), and Gaussian noise augmentation (green) for DeepLabV3+ and PSPNet on Cityscapes, Gaussian noise augmentation performs worse than both alternatives due the high noise levels required for amplifi- cation. 1/2975, private patch size 10 10.
DeepLabV3+ A2D2
PSPNet A2D2
0.30
0.95
0.3
mloli
mloU
0.20
0.2
0.15
Patch Level Subeampling
Patch Level Subsurpling
Minibatch Suteumpling
Minbbatch Subsampling
0.06
Gaussion Noise Angreentaton
Cousian Noise Augmentation
26
20
100
20
20
80
80
100
Privacy-utility tradeoff comparing patch-level subsampling (blue), minibatch subsampling (or- ange), and Gaussian noise augmentation (green) for DeepLabV3+ and PSPNet on A2D2. Gaussian noise augmentation performs worse than both alternatives due the high noise levels required for amplification. 8 1/18557, private patch size 10 x 10.
Figure 12:
it cannot recover utility, as reflected by the divergence and high variance in Figure 14 In such cases, one would not use cropping and instead revert to standard DP-SGD with minibatch subsampling.
D Additional Experiments
D.1 Privacy Profile Experiments
In the main text, we reported privacy profiles for representative setup. Here, we provide additional variations to demonstrate robustness. We use the hyperparameter values stated in App. C.4
28

---

Published in Transactions on Machine Learning Research (03/2026)
ResNet 18 on DTD
VGG 11 on DTD
0.5
0.1
Amirsey
Accuracy
0.2
0.1
Pateb-Level Subeampling Minibatch Suleampingg
Pateh-Leve Subeampling
Minibatch Sabsampling
0.0
20
40
Figure 13: Model performance versus privacy-level = for DP-SGD with patch-level sampling (blue) and minibatch subsampling (orange). Results are averaged over four seeds; error bars show standard deviation. We use 1/1879, following l//epcch_ssttteeeeeeeeeeeeeeeese size and a private patch size of 5 5 is assumed. DG-SGD with patch-level privacy overperforus significantly, given the exact same setup.
ResNet-18 MNIST
VGG-11 MNIST
0.18
0.36
0.15
0.16
0.14
Accuracy
0.14
0.12
0.11
Patch-Level Subsempling
Patch-Leve Subsampling
0.10
Minibatch Subampling
Minibatch Subsampling
20
100
0
20
10
60
100
Figure 14: Model performance versus privacy-level e for DP-SGD with patch-level sampling (blue) and minibatch subsampling (orange). Results are averaged over four seeds; error bars show standard deviation. We use 8 1/60000, following 1/epoch_ssteeeeee size and private patch size of 5 is assumed.
D.1.1 Varying Noise Levels
We vary the Gaussian noise multiplier across a E (1, 4}, fixing crop size 100 100, and private patch size 10 10. For the data-level noise baseline, we set datta 1000. As expected, we observe in Fig. [7 that larger noise multipliers reduce privacy leakage, shifting the profiles downward. Notably, while the data-level baseline requires extreme values such ddata 1000 to achieve modest privacy protection, comparably small increases in the multiplier for patch-level subsampling yield meaningful improvements.
D.1.2 Varying Private Patch Size
We next analyze the effect of enlarging the private region itself. Fixing crop size to 100 100 and Gaussian noise multiplier 1, vary the private patch side length across {10,20 20, 40), while keeping the data-level
29

---

Published in Transactions on Machine Learning Research (03/2026)
0.45
0.40
0.40
0.36
0.35
Arcuracy
0.30
Accurscy
0.30
0.25
0.25
0.20
0.90
0.15
0.10
Patch Level Suleampling
0.10
Patch: Level Sulsampling
0.05
Minibazeh Subewmpling
0.05
Minibatch Subsampling
0
20
40
100
0
20
40
60
106
(a) Seed 10
(b) Seed 20
0.40
0.40
0.35
0.35
0.30
Accuracy
Avcuracy
0:25
0.25
0.20
0.20
0.15
0.15
0.10
0.10
Patch-Level Subeumpling
Patch-Level Subsampling
0.05
Minibazeh Subeumpling
0.05
Minibateh Subsampling
0.00
0
20
40
80
100
0
20
40
60
80
106
(c) Seed 30
(d) Seed 516
Figure 15: Per-seed privacy-utility tradeoffs of ResNet-18 on DTD. We assume a private patch size of 5 x 5,
and set 8 = 1/1879.
bascline constant at Odata 1000. As shown in Fig. 18 larger private patches gradually bring patch-level subsampling closer to the behavior of standard minibatch sampling, since the intersection probability between the crop and the private region increases. This reduces the effective amplification and slowly narrows the gap between the two methods. Additionally, the negative effect of enlarging private patches is even more pronounced for the data-level baseline, where privacy leakage grows substantially despite already extreme noise levels.
D.1.3 Varying Crop Sizes
We now examine how the choice of crop size influences the privacy profiles. Fixing private patch size to 20 x 20 and Gaussian noise multiplier a = 2, we vary the crop side length across {100, 200, 400} pixels. For the data-level baseline, we again fix ddata = 1000. As shown in Fig. 19 larger crop sizes weaken the benefits of patch-level subsampling, and its privacy profiles shift upward toward the minibatch sampling privacy profile as crop size grows. The effect and its reasoning are very similar to those of private patch size, but it has zero effect both of the baseline privacy profiles.
D.1.4 Varying Image Resolution
We now analyze the effect of changing the overall image resolution while keeping other parameters fixed. We compare experiments with image sizes of 1000 x 1000 and 2000 x 2000, fixing crop size 200 x 200, private patch size 20 20, and Gaussian noise multiplier o 2. The data-level bascline is again set daata 1000. As shown in Fig. 20 increasing the image resolution strengthens the relative amplification
30

---

Published in Transactions on Machine Learning Research (03/2026)
0.4
0.4
Accuracy
0.3
Accursoy
0.3
0.1
Patch Level Suleampling
Patch Level Sulsampling
Minibazeh Subewmpling
Minibatch Subsampling
20
40
80
80
100
0
20
40
60
100
(a) Seed 10
(b) Seed 20
0.5
0.4
0.1
Accuracy
Avcuracy
0.3
0.2
0.1
Patch-Level Su Subeampling
Patch-Level Subsampling
Minibazeh Subeumpling
Minibateh Subsampling
0
20
40
60
80
100
0
20
40
60
80
100
(c) Seed 30
(d) Seed 516
Figure 16: Per-seed privacy-utility tradeoffs of VGG-11 on DTD, We assume a private patch size of 5 x 5, and set 8 = 1/1879.
of patch-level subsampling. The effect and reasoning behind it are the same in crop size, just for the variation in the opposite direction. An increase in the image size affects the privacy profile of patch-level subsampling positively, whereas an increase in the crop size affects it negatively.
D.1.5 Varying Lata-Level Noise
We finally lurn to the data-level noise addition baseline and vary the injected noise standard deviation directly. Fixing crop size to 200 x 200, private patch size to 20 20, Gaussian noise multiplier o = 2, and image resolution 1000 x 1000, we compare daata E {1000, 2000}. As shown Fig. 21] even doubling the standard deviation of pixel-level Gaussian noise fails to match the privacy guarantees achieved by patch-level subsampling in this setup.
D.1.6 Varying Private Patch Geometry
In the main text and experiments above, assume square private patches. Here, demonstrate that our framework generalizes to arbitrary shapes, as discussed in Section 4.4 While closed-form expressions
exist. for rectangles (and squares) (Lemıma [], inclusion probabilities for other shapes can be computed by
iterating over all crop positions. We compare privacy profiles for three geometries: (1) rectangular patches with varying aspect ratios, (2) circular regions (c.g., approximating faces), and (3) irregular blobs (cluster
of circles). Results are shown in Figure 22 These results confirm that our theoretical framework extends
beyond square patches, and practitioners can use domain-approppratee shapes for tighter analysis.
31

---

Published in Transactions on Machine Learning Research (03/2026)
1.0
1.0
Patch-Level Subsampling
Patch-Level Subsampling
Minibatch Suhsampling
Minibatch Subsampling
0.8-
0.8
Data-Love Noisc
Data-Leve Noise
0.6
0.6
5(E)
8(c)
0.4
0.4
0.2-
0.2
0.0-
0.0
10
10
10
10
10
10
10
10
102
10
8
6
(a)
(b)
2
1.0
Patch- Lvel Subsampling
Minibatch Subsampling
0.8
Data-Level Noise
0.6
8(8
0.2
0.0
10
10'
(c) a =
Figure 17: Privacy profiles for different mechanisms: DP-SGD with patch-level subsampling (blue), standard minibatch subsampling (orange), and data-level noise addition (green). We vary the noise levels o for the subsampling mechanisms, while keeping the data-level baseline fixed ddata = 1000.
D.2 Additional Experiments on Crop and Patch Size
In Section 5.2 we analyzed how the privacy parameter E varies with crop size and private patch size, highlighting the role of intersection probability in determining the strenghh of patch-level amplification. There, we reported results for a representative setting with E {4.0, 4.5, 5.03. Here, we expand these experiments by systematically varying the Gaussian noise multiplier and repeating the sweeps across two image resolutions. As before, we fix epoch_ ssizeesiee 105, and 8 1/epoch_ size and perform two sweeps in each configuration (1) varying crop sizes with private patch size fixed at 10 x 10, and (2) fixing crop size. at 450 x 450 while varying private patch sizes. Together with the sensitivity analyses in Appendix D.1] these results confirm that our findings are robust across a wide range of settings.
We vary the Gaussian noise multiplier between 1.0 and 5.0 steps of 0.5, and repeat both sweeps at two image resolutions: 1000 1000 (Figures 23 25 and 1000 2000 (Figures 26
28
As expected, larger noise crop and patch size remains
multipliers uniformly lower the curves, while the qualitative dependence unchanged. For the crop-size sweeps, rises rapidly with increasing crop size and saturates once inter- section probability reaches 1, at which point patch-level subsampling collapses to the minibatch bascline. For the patch-size sweeps, & grows approximately linearly with the side length of the privale region, again approaching the minibatch baseline at saturation. Importantly, the rectangular image resolution illustrates that saturation not guarantced, even with very large crops or patches. Depending on the image dimen- sions, the intersoction probability may never reach 1, and patch-level subsampling preserves an advantage throughout. This reinforces that dataset geometry itself can modulate the strength of amplification.
32

---

Published in Transactions on Machine Learning Research (03/2026)
1.0
1.0
Patch-Level Subsampling
Patch-Level Subsampling
Minibatch Suhsampling
Minibatch Subsampling
0.8
0.8
Data-Love Noise
Data-Level Noise
0.6
0.6
5(E)
8(c)
0.4
0.4
0.2
0.0-
0.0
10
10
10
10a
10
10
10
10
102
10
8
6
(a) Private patch 10 10
(b) Private patch 20
20
1.0
Patch-Level Subsampling
Minibatch Subsampling
0.8
Data-Level Noise
0.4
0.2
0.0
10
(c) Private patch 40 x 40
Figure 18: Privacy profiles for different mechanisms under varying private patch sizes: DP-SGD with patch- level subsampling (blue) and standard minibatch subsampling (orange) with identical o = 1, and data-level noise addition (green) with datta = 1000.
D.3 Influence of Padding on Privacy
Finally, investigate how image padding affects the strength of patch-level amplification. Padding alters the effective geometry of the cropping operation by adding empty pixels along the edges of the image before cropping. Therefore, it modulates the intersection probability between the private region and the sampled crop.
Unless otherwise stated, all experiments use images size 1000 1000, clipping norm C' = 2.0, batch size 100, epoch size 3000, and 100 training epochs. We fix 1/epoch_ste size and assume epoch_size 10 throughout. On top of these defaults, we perform three sweeps under varying padding configurations: (1) varying crop side lengths with private patch size fixed at 10 10 and Gaussian noise multipliers e {4.0, 4.5, 5.0}, (2) varying private patch sizes with crop size fixed at 500 x 500 and the same set of noise multipliers, and (3) varying Gaussian noise multiplicrs with crop size fixed at 500 x 500 and private patch size 20 x 20. In each case, we repeat the experiment under multiple padding values to assess their influence on E. Figures 29 31 show the results.
33

---

Published in Transactions on Machine Learning Research (03/2026)
1.0
Patdi-Leve Subeampling
Patch-Lovel Subsampling
Minibatch Subsampling
Minibatch Subsampling
0.8
0.8
Data- evel Noise
Data-Love Noise
0.6
0.6
0.4-
0.4
0.2
0.0
0.0
10
10P
10
10
10
10
10
10
10a
10
8
(a) Crop 100 x 100
(b) Crop 200 x 200
1.0
Batch-Levol Subsemuplig
Minibatch Subsampling
Data- Devel Noise
0.6
81e)
0.4
0.2
10
10
10
10a
10
(c) Crop 400 400
Figure 19: Privacy profiles for different mechanisms under varying crop sizes: DP-SGD with patch-level subsampling (blue) and standard minibatch subsampling (orange) with identical o = 2, and data-level noise addition (green) with daata = 1000.
1.0
1.0
Pateh-Level Subsampling
Patch-Level Subsampling
Minibatch Suhsampling
Minibatch Subsampling
0.8-
0.8
Data-Level Noise
Data Level Noise
0.6
0.6
8(c)
0.4
0.4
0.2
0.0-
0.0
10-1
10a
10
102
10
10
10
10
10a
10a
8
6
(a) Image 1000 1000
(b) Image 2000 2000
Figure 20: Privacy profiles for different mechanisms under varying image resolutions: DP-SGD with patch- level subsampling (blue), standard minibatch subsampling (orange), and data-level noise addition (green). Crop size 200 x 200, private patch 20 x 20, = 2, ddata 1000.
34

---

Published in Transactions on Machine Learning Research (03/2026)
1.0
1.0
Patch-Leve Subeampling
Patch-Level Subsampling
Minibatch Subsampling
Minibatch Subeampling
0.8-
0.8
Data-Levo Noise
Data- Level Noise
0.6
0.6
6is)
86
0.4
0.4
0.2-
0.2
0.0
0.0
10'
10
10
10
10
10
10
10
(a) daata 1000
(b) datta = 2000
Figure 21: Privacy profiles for different mechanisms under varying data-level noise standard deviations: DP- SGD with patch-level subsampling (blue), standard minibatch subsampling (orange), and data-level noise addition (green). Crop size 200 200, private patch 20 20, == 2.
1.0-
1.0
Patch-Level Subeampling
Patch-Level Subsampling
Minibatch Subsampling
Minibatch Subsampling
0.8
0.8
Data-Level Noise
Data-Lowe Noise
0.6-
0.6
0.4
0.4
0.2
0.2
0.0-
0.0
10a
10"
10
10a
10
10
10
10
10a
10a
e
e
(a) Square-shaped private patch of size 10 10
(b) Reclangle-shaped private patch of size 20 x 10
1.0
Latch-Level Suleampling
1.0
Patch-Lovel Subsompling
Mimibatch Subsampling
Minibateh Subsamplingg
0.8-
Data-Level Noise
Data-Level Noise
0.6
0.6
Kie)
0.4
0.4
0.2
0.2
0.0
0.0
10
10
10
10a
10
10
10a
10P
(c) Circle-shaped private patch with radius 5
(d) Private patch with shape of cluster of 2 distinct circles, each circle with radius r and a gap between of 2 pixels
Figure 22: Privacy profiles for different mechanisms: DP-SGD with patch-level subsampling (bluc), standard minibatch subsampling (orange), and data-level noise addition (green). We vary the shapes of the private patches.
35

---

Published in Transactions on Machine Learning Research (03/2026)
400
Patch-Lovel Subsampling
400
Patch- Subsampling
Minibatch Subsampling
Minibatch Subsempling
350
350
300
250
250
200
200
150
150
100
100
50
1.5
50
1.5
2
400
600
20
100
120
Crop side length [pixels
Private patch side length [pixels]
Figure 23: E as function of crop size (left)) and private patch size (right), at 5 10-5 and image resolution 1000 1000 for {1.0, 1.5, 2.0}.
7
Lovel Subsampling
Patch-Level Subeampling
Minibotch Subsampling
Minibatch Subsampling
6-
6
5-
4
3
2
3-
2.5
3
3.5
2-
3.5
0-
100
200
300
400
500
600
700
20
40
100
120
Crop side length [pixels]
Private patch side length [pixels]
Figure 24: E as function of crop size (left) and private patch size (right), at 8 10-5 and image resolution 1000 1000 for 3.0,,
36

---

Published in Transactions on Machine Learning Research (03/2026)
2.2
Lovel Subsampling
Patch-Leve Subsamphing
2.0
Minibatch Subeampling
Minibatch Subsampling
2.0
1.5
1.8
1.6
1.0
1.4
0.5
1.2
4.5
4.5
5
1.0
5
0.0
200
100
120
Crop side length [pixels]
Prisate patch side length [pixels]
Figure 25: e as function of crop size (left)) and private patch size (right), at 5 10-5 and image resolution 1000 1000 for {4.0, 4.5, 5.03.
100
Patch-Level Subsampling
400
Patch- Subsampling
Minibatch Subsampling
Minibatch Subsempling
350
350
300
300
250
250
200
200
150
150
100
100
50
1.5
50
1.5
0
200
400
1000
20
40
60
100
120
Crop side length [pixels]
Private patch side length [pixels]
Figure 26: E as function of crop size (left) and private patch size (right), at 8 10-5 and image resolution
1000 2000 for 11.0,1.5,22 2.0}.
37

---

Published in Transactions on Machine Learning Research (03/2026)
Batch-Level Subsampling
Patch-Level Subeampling
Minibatch Subeampling
Minibatch Subsampling
6
6
0-
5-
10
3
2
2-
2.5
2.5
1
1
3.5
3.5
0-
200
400
600
800
1000
20
40
80
100
120
Crop side length [pixels]
Private patch side length [pixels]
(a)
(b)
Figure 27: as function of crop size (left) and private patch size (right), at ô = 10-5 and image resolution 1000 x 2000 for 2.0,
2.25
Lateh-Level Subsampling
Patch-Level Suteampling
2.0
Minibatch Subeampling
2.00
Minibatch Subsampling
1.75
1.5
1.50
1o
1.25
1.0
1.00
0.5
4.5
0.50
4.5
0.0
0.25
200
400
600
800
1000
20
40
60
80
100
120
Crop side length [pixek]
Private patch side length [pisels]
(a)
(b)
Figure 28: function of crop size (left) and private patch size (right), at 5 10-5 and image resolution 1000 x 2000 for {4.0, 4.5, 5.0}.
38

---

Published in Transactions on Machine Learning Research (03/2026)
2.25
2.2
Patch-Level Subsampling
Patch-Level Sabsampling
2.00
Minibatch Subsampling
2.0
Minibatch Subsampling
1.75
1.8
Epsilon (E)
1.50
Epsilon (
1.6
1.4
1.25
1.2
1.00
1.0
0.75
4
4.5
4.5
0.8
0.50
5
5
10
20
30
50
10
20
40
50
Padding Amount (pixels)
Padding Amount (pixels)
(a) Crop size 400 x 400
(b) Crop size 450 x 450
2.2
Patch-Level Suhsampling
Minibatch Subsempling
2.0
1.8
Epsilon (s)
1.6
1.4
1.2-
4.5
1.0-
0
10
20
30
40
50
Padding Amount (pixels)
(c) Crop size 500 x 500
Figure 29: E vs. padding amount for crop sizes (a) 400 x 400, (b) 450 x 450, (c) 500 x 500, with patch size x 10 and noise multipliers E (4.0, 4.5, 5.0}.
39

---

Published in Transactions on Machine Learning Research (03/2026)
2.2
Patch-Level Su Suheampling
Patch-Level Sabsampling
Minibatch Subeampling
Minibateh Subsampling
2.0
2.0
1.8
Epsilon (e)
1.6
Epsilon
1.6
1.4
4.5
1.2
4.5
5
5
1.0-
1.0
10
20
40
50
10
20
50
Padding Amount (pixels)
Padding Amount (pixels)
(a) Private patch size 10
10
(b) Private patch size 20 x 20
2.2
Fatch-Levee Suhsampling
Minibatch Subsempling
2.0
1.8
Epeilon (s)
1.6
1.4
4.5
1.2
0
10
20
30
40
50
Padding Amount (pixels)
(c) Private patch size 40 x 40
Figure 30: 6 vs. padding amount for private patch sizes (a) 10 10, (b) 20 x 20, (c) 40 40, with crop size 500 500 and noise multipliers a E (4.0, 4.5, 5.0).
40

---

Published in Transactions on Machine Learning Research (03/2026)
400
Pateli-Level Subeampling
Pateh-Leeel Subeampling
Minibatch Subsampling
Minibatch Sulsampling
350
300
Epailon (s)
Epsilon
150
100
2.5
50
1.5
3
2
3.5
2
10
20
30
50
10
20
30
40
50
Padding Amount (pixels)
Padding Amount (pixels)
(a)
(b)
2.2
Patch- Level Suhsampling
Minibateh Subsempling
2.0
1.8
Epeilon (s)
1.6
1.4
1.2
4.5
1.0
0
10
20
30
40
50
Padding Amount (pixels)
(c)
Figure 31: E vs. padding amount for noise values (a) a {1.0, 1,,, (b) E (2.5,3.0,355), (c) e (4.0, 4.5, 5.0}, with crop size 500 500 and private patch size 20 20.
41


Reviews:
[{"review_id": "5QcWqn06By", "reviewer": "Reviewer_8qgn", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a domain-aware refinement of differential privacy analysis for vision models trained with DP-SGD by showing that random cropping, a data augmentation technique, provides additional privacy amplification when sensitive information is spatially localized. The authors introduce a patch-level neighboring relation in which two datasets differ only within a bounded region of a single image, reflecting privacy risks such as faces or license plates and avoiding overly conservative image-level assumptions. Under this notion of privacy, random cropping is formalized as a stochastic mechanism that probabilistically excludes the private patch from the model’s input. The paper derives tight theoretical bounds showing that this patch-level randomness composes naturally with minibatch subsampling, resulting in a reduced effective sampling rate and stronger privacy guarantees for DP-SGD. The amplification is obtained without modifying the training algorithm, model architecture, or adding computational overhead, making it a drop-in improvement in privacy accounting. Experiments on semantic segmentation benchmarks further demonstrate improved privacy–utility trade-offs, validating the practical relevance of the proposed analysis.", "claims_and_evidence_yn": "No", "claims_explanation": "The paper presents a theoretical analysis demonstrating that patch-level randomness introduces additional privacy guarantees, and provides empirical results illustrating the effects of different sampling strategies and patch sizes on privacy, as well as the resulting privacy–utility trade-offs under patch-level subsampling. However, several aspects require further clarification or justification:\n\n1. In Section 4.2, the criteria for selecting the crop dimensions $H_C$ and $W_C$ are unclear. In practice, if either $H_C$ or $W_C$ is too small, the crop may fail to preserve any private information, which could undermine the intended privacy analysis.\n\n2. The patch inclusion probability is defined as the probability that a randomly sampled crop intersects with region R. It is unclear why this definition is adopted instead of considering the probability that a crop fully covers region R, given that the private information is removed only when the entire region R is substituted.\n\n3. The role and interpretation of the parameter $\\alpha$ in Theorem 2 are not clearly explained and should be explicitly defined.\n\n4. Sections 5.1 and 5.2 restrict the analysis to rectangular crops and patches. However, as noted by the authors, patches may also take the form of irregular blobs. It would be helpful to clarify whether and how the proposed analysis extends to such non-rectangular patch shapes.\n\n5. Finally, it would be nice to include a comparison of the privacy–utility trade-offs with the Gaussian data augmentation method proposed by Schuchardt et al. (2025), evaluated under the same experimental settings.", "audience_yn": "Yes", "audience_explanation": "The paper focuses on domain-aware refinement of differential privacy analysis and adopts random cropping as a solution, which may be of interest to a subset of the TMLR audience.", "requested_changes": "Besides the points raised above, the following additional revisions are requested:\n\n1. The notation in Definition 3 requires further clarification. Specifically, x(s, t) should be defined before it is used. The region R is described as rectangular, whereas [H] x [W] appears to denote an arbitrary region; additional constraints should be specified to resolve this inconsistency. Moreover, the notation used for a dataset x and an individual sample x_i is potentially confusing; using X to denote the dataset would improve clarity.\n\n2, The experimental evaluation would be strengthened by including additional datasets beyond the segmentation setting.\n\n3. In practice, privacy budgets epsilon are typically small. It would therefore be beneficial to include more data points corresponding to smaller values of $\\epsilon$ (for example, $\\epsilon < 10$) in Figure 5.", "broader_impact_concerns": "The paper does not have broader impact concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "uHXf8T916K", "reviewer": "Reviewer_htuJ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces patch-level differential privacy for vision models, redefining the neighboring relation to allow localized substitutions within an image. The work shows that the standard technique of random cropping acts as a free privacy amplification mechanism. The authors derive tight patch-inclusion probabilities, showing how this composes with minibatch subsampling, and demonstrate meaningful privacy-utility improvements on semantic segmentation tasks (DeepLabV3+, PSPNet; Cityscapes, A2D2).\n\nStrength:\n\n-- The key insight that random cropping inherently introduces a second, spatial sampling process is elegant and interesting. The paper formalizes something practitioners implicitly rely on yet never quantified: sensitive content may simply not appear in a crop, reducing exposure probability.\n\n-- The derivation of patch-inclusion probability is correct and intuitive. The privacy amplification result (Theorem 2) generalizes standard subsampling bounds. The proofs are clean and the authors show tightness for DP-SGD via a constructive worst-case example. The connection to dominating pairs and PLD accounting is also thorough and interesting.\n\n-- The overall idea is intuitive and simply a new privacy definition more aligned with actual risk scenarios.\n\nWeakness:\n\n-- The approach assumes a known fixed private patch (e.g., 10×10). In real datasets, sensitive regions (like faces or license plates) vary in position, size and shape. This limits deployment unless conservative over-estimates are used. The paper acknowledges this but does not explore adaptive or detection-based patch modeling.\n\n-- A crop is treated as either “includes sensitive region” or “does not”. But in practice, even partial inclusion may leak varying amounts of information. A more graded, overlap-aware formulation could yield tighter (less conservative) privacy bounds.\n\n-- The amplification benefits require high resolution images, random cropping with substantial downscaling and spatially localized privacy-critical information. Tasks without cropping (e.g., CIFAR-10, MNIST, small-resolution datasets) do not benefit. This limit is mentioned but deserves sharper discussion on scope.\n\n-- While done for fairness, some DP-SGD baselines may be under-tuned. For example, DeepLabV3+ on A2D2 shows instability. Larger crop sizes or tuned LR schedules could shift baselines. The improvements remain credible but could partly reflect suboptimal baselines.\n\n-- All experiments assume a small, square patch at arbitrary location. Real sensitive patterns can be elongated (license plates), elliptical (faces) or distributed clusters. Some experiments or simulations with varied geometries would strengthen the claim of generality.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Yes, the claims are supported by clear and convincing evidence. The theoretical guarantees are rigorously derived, with tightness results that validate the amplification effect under patch-level substitutions. The empirical results further reinforce these claims. Privacy profiles consistently show stronger guarantees than minibatch subsampling and the privacy–utility experiments across two architectures and datasets demonstrate substantial, repeatable gains. While some assumptions, such as fixed patch size—could be clarified, the core arguments are accurate, well-justified and strongly backed by both theory and experiments.", "audience_yn": "Yes", "audience_explanation": "Yes. This work is clearly of interest to a segment of the TMLR audience. It introduces a simple yet impactful refinement to differential privacy accounting that leverages a ubiquitous vision operation (random cropping) to obtain stronger privacy guarantees “for free.” Researchers working on DP-SGD, privacy amplification, vision models and domain-aware privacy mechanisms would benefit from these findings, as the paper offers both a novel theoretical perspective and practical improvements without altering training pipelines.", "requested_changes": "-- The current analysis assumes a fixed and known private region size (e.g., 10×10). Please clearly articulate how practitioners should choose this parameter in real-world settings where sensitive regions vary significantly in size and shape (e.g., faces, license plates).\n\n-- Add a discussion about conservative bounding vs. dataset-dependent estimation.\n\n-- Provide clearer justification for the binary inclusion model. The analysis treats crop–patch interactions as a binary event (“intersects” vs “does not”).\n\n-- Clarify the implications of ignoring fractional overlap.\n\n-- Explain how conservative this approximation is, and whether it can substantially loosen the privacy guarantee. A brief note on what would be required to extend the analysis to overlap-aware weighting would improve rigor.\n\n-- Strengthen discussion on scope and limitations of applicability. Patch-level amplification only helps when cropping is standard practice and when images are high resolution. Please expand the limitations section to explicitly note tasks that will not benefit (e.g., small-resolution datasets, non-cropping pipelines).", "broader_impact_concerns": "Nil", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "nwZpxl57qO", "reviewer": "Reviewer_HPaG", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "In this paper, Amplified Patch-Level Differential Privacy for Free via Random Cropping, authors propose a principled way to get privacy amplification in vision DP-SGD by using randomness from random cropping. The privacy gain comes without having to change model architecture or training procedure. They introduce a patch-level neighboring relation, where two datasets differ only within a bounded region of a single image. This additional sampling effect, when composed with standard minibatch subsampling, leads to tighter privacy bounds and improved model utility without modifying the training pipeline. The work is promising but needs a major revision.\n\nStrengths:\n\n•\tIntroduction reads well and the motivation is described clearly\n\n•\tStrong theoretical link between random cropping, a data augmentation technique, and privacy amplification\n\n•\tTreating random cropping as a source of privacy amplification\n\n•\tThe privacy amplification is achieved “for free,” and without modifying the training pipeline\n\nWeaknesses:\n\n•\tThe evaluation is only limited to semantic segmentation", "claims_and_evidence_yn": "No", "claims_explanation": "The proposed claims are broad. All empirical evaluations are limited to semantic segmentation, but the method is claimed to be broadly applicable across vision tasks. Some potential problems in simpler classification tasks (like MNIST) are briefly mentioned, but no further discussions or experiments are presented to validate whether the amplification benefits persist in other settings.", "audience_yn": "Yes", "audience_explanation": "The paper is about differential privacy in deep learning, a core topic for TMLR. There are many previously published papers in TMLR, addressing and improving differential privacy in different settings.", "requested_changes": "Critical comments:\n\n• Consider adding a discussion on how patch-level DP relates to normal (record-level) DP and when the former is the right guarantee for the application.\n\n• The paper assumes a known private patch size. Please discuss how misidentifying or unknown private regions could reduce protection that does not affect the privacy notion here. Additionally, the real data might involve multiple sensitive regions. A discussion and analysis should be added.\n\n• All reported privacy–utility tradeoffs are on semantic segmentation tasks. Since the paper itself notes random cropping can hurt performance in simpler datasets such as MNIST, please include results on a classification task. In order to show the privacy improvement generalizes beyond segmentation.\n\n\nSuggestions:\n\n• Definition 3 states “x_i(s,t)\\neq x_i^\\prime(s,t) for some (∃ vs. ∀)  (s,t)\\in R.”\nPlease confirm and discuss that the intent is an unbounded in-region substitution. In other words, outside R, the images are identical, while inside R, any modification, including a single-pixel change, constitutes adjacency. And the entire R region is not necessarily privatized, as demonstrated in Figure 1.\n\n• δ choices are inconsistent across sections and need unification. Both δ=10⁻⁵ and δ=1/epoch_size have been used.\n\n• Reproducibility of the results is a concern. Results on Cityscapes have high error bars, at some points, minibatch subsampling showing better performance. Please discuss this in section 5.3.\n\n• In the privacy-utility figure captions, please explicitly state δ and patch size.", "broader_impact_concerns": "The paper introduces patch-level DP, which is weaker than standard record-level DP, and this distinction may be misunderstood. The method also assumes a fixed known sensitive region, and unknown private regions or misidentifying them could hurt the actual privacy. The approach might be capable of training better performing models under relaxed privacy notions, so there is potential for misuse.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)