On Choosing the $μ$ Parameter in Gaussian Differential Privacy
2026-06-08 • Machine Learning
Machine Learning
AI summaryⓘ
The authors looked at how to convert between two ways of measuring privacy in machine learning: pure differential privacy (DP) and Gaussian differential privacy (GDP). They focused on matching how well an attacker could guess if a person's data was used, using three different measurement methods. Based on their findings, they provide a simple rule to convert DP's ε to GDP's μ by roughly dividing ε by 5. This helps practitioners report privacy guarantees more consistently.
Differential PrivacyGaussian Differential PrivacyMembership Inference AttackPrivacy GuaranteeFalse Positive RatePrecisionRecallPrivacy ProfileAdversary ModelMachine Learning Privacy
Authors
Bogdan Kulynych, Antti Honkela
Abstract
Recent work argues for using Gaussian differential privacy (GDP) to report the privacy guarantees in privacy-preserving machine learning. We provide principled mappings from pure-DP $\varepsilon$ to GDP $μ$ by matching the worst-case success of a strong-adversary membership inference attack in terms of three metrics: multiplicative advantage at fixed FPR, precision at fixed recall, and the standard privacy profile. We tabulate $μ$ values across a useful range of parameters and recommend $μ\approx \varepsilon/5$ as a conservative general-purpose conversion.