Paper Summary: Deep Learning with Differential Privacy (Abadi et al., 2016)

This seminal paper, published at ACM CCS 2016, is the foundational work that made modern private deep learning practical. It bridged the gap between theoretical differential privacy (DP) and empirical machine learning.

1. The Core Challenge

Before this paper, deep learning models were notorious for memorizing sensitive training data, making them vulnerable to membership inference and reconstruction attacks. While Differential Privacy offered a rigorous mathematical framework to guarantee privacy, training deep neural networks with acceptable accuracy (utility) under meaningful privacy budgets ($\epsilon$) was considered computationally unfeasible and mathematically restrictive.

2. The DP-SGD & Moments Accountant Solution

The authors resolved this by introducing DP-SGD (Differentially Private Stochastic Gradient Descent), which modifies the optimization loop at the sample level:

• Per-Sample Gradient Clipping: Each individual gradient in a batch is clipped to a maximum $\ell_2$-norm threshold $C$ to restrict the influence of any single data point.
• Noise Addition: Calibrated Gaussian noise is added to the summed gradients before the parameter update.
• Moments Accountant: The authors designed a novel privacy tracking mechanism that bounds the moments of the privacy loss variable. This provided much tighter bounds for composition compared to standard advanced composition, allowing deep networks to train for thousands of steps under realistic privacy budgets ($\epsilon < 10$).

3. Key Takeaway & Industry Impact

This paper is the blueprint for modern privacy-preserving machine learning. By showing that models could be trained privately on MNIST and CIFAR-10 with solid utility, it laid the groundwork for production-grade private learning libraries like PyTorch Opacus and TensorFlow Privacy. Today, it remains the standard reference point for anyone designing private generative models or federated learning pipelines.