{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/attack-aware-noise-calibration-for","title":"Attack-Aware Noise Calibration for Differential Privacy","arxiv_id":"2407.02191","date":"2024-07-02","proceeding":null,"authors":["Bogdan Kulynych","Juan Felipe Gomez","Georgios Kaissis","Flavio du Pin Calmon","Carmela Troncoso"],"abstract":"Differential privacy (DP) is a widely used approach for mitigating privacy risks when training machine learning models on sensitive data. DP mechanisms add noise during training to limit the risk of information leakage. The scale of the added noise is critical, as it determines the trade-off between privacy and utility. The standard practice is to select the noise scale to satisfy a given privacy budget $\\varepsilon$. This privacy budget is in turn interpreted in terms of operational attack risks, such as accuracy, sensitivity, and specificity of inference attacks aimed to recover information about the training data records. We show that first calibrating the noise scale to a privacy budget $\\varepsilon$, and then translating {\\epsilon} to attack risk leads to overly conservative risk assessments and unnecessarily low utility. Instead, we propose methods to directly calibrate the noise scale to a desired attack risk level, bypassing the step of choosing $\\varepsilon$. For a given notion of attack risk, our approach significantly decreases noise scale, leading to increased utility at the same level of privacy. We empirically demonstrate that calibrating noise to attack sensitivity/specificity, rather than $\\varepsilon$, when training privacy-preserving ML models substantially improves model accuracy for the same risk level. Our work provides a principled and practical way to improve the utility of privacy-preserving ML without compromising on privacy. The code is available at https://github.com/Felipe-Gomez/riskcal","url_abs":"https://arxiv.org/abs/2407.02191v2","url_pdf":"https://arxiv.org/pdf/2407.02191v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"attack-aware-noise-calibration-for","repo_url":"https://github.com/bogdan-kulynych/riskcal","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"attack-aware-noise-calibration-for","repo_url":"https://github.com/felipe-gomez/riskcal","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"privacy-preserving","task_name":"Privacy Preserving"},{"task_slug":"sensitivity","task_name":"Sensitivity"},{"task_slug":"specificity","task_name":"Specificity"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2407.02191","atlas_url":"https://app.syntology.ai/?focus=2407.02191","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2407.02191"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/google/differential-privacy","reach":null},{"provenance":"deterministic:regex_extraction","url":"https://github.com/Felipe-Gomez/riskcal","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/felipe-gomez/riskcal","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/bogdan-kulynych/riskcal","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":4},"by_repo_kind":{"official":{"samples":4,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"8352363ee57606c1","entry":"get_FNR_case1_vec","repo":"bogdan-kulynych/riskcal","repo_kind":"official","path":"src/riskcal/analysis/rdp/pure.py","file_url":"https://github.com/bogdan-kulynych/riskcal/blob/HEAD/src/riskcal/analysis/rdp/pure.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8352363ee57606c1"}},{"code_sha256_prefix":"46b87ad43702e7e2","entry":"get_fixed_point_case1","repo":"bogdan-kulynych/riskcal","repo_kind":"official","path":"src/riskcal/analysis/rdp/pure.py","file_url":"https://github.com/bogdan-kulynych/riskcal/blob/HEAD/src/riskcal/analysis/rdp/pure.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"46b87ad43702e7e2"}},{"code_sha256_prefix":"324a3e29f2a25b00","entry":"get_fixed_point_case2","repo":"bogdan-kulynych/riskcal","repo_kind":"official","path":"src/riskcal/analysis/rdp/pure.py","file_url":"https://github.com/bogdan-kulynych/riskcal/blob/HEAD/src/riskcal/analysis/rdp/pure.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"324a3e29f2a25b00"}},{"code_sha256_prefix":"0e6110126ad4d01f","entry":"inverse_monotone_function","repo":"bogdan-kulynych/riskcal","repo_kind":"official","path":"src/riskcal/utils.py","file_url":"https://github.com/bogdan-kulynych/riskcal/blob/HEAD/src/riskcal/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0e6110126ad4d01f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}