ML Security PapersOn the Fairness of Privacy Protection: Measuring and Mitigating the Disparity of Group Privacy Risks for Differentially Private Machine Learning
Zhi Yang 1, Changwu Huang 1, Ke Tang 1, Xin Yao 2
Published on arXiv
2510.09114
Membership Inference Attack
OWASP ML Top 10 — ML04
Key Finding
The proposed approximate worst-case MIG reveals significantly greater group privacy risk disparities than average-case methods, and the adaptive DP-SGD algorithm measurably reduces inter-group privacy leakage disparity.
Approximate Worst-Case MIG + Adaptive Group-Specific DP-SGD
Novel technique introduced
While significant progress has been made in conventional fairness-aware machine learning (ML) and differentially private ML (DPML), the fairness of privacy protection across groups remains underexplored. Existing studies have proposed methods to assess group privacy risks, but these are based on the average-case privacy risks of data records. Such approaches may underestimate the group privacy risks, thereby potentially underestimating the disparity across group privacy risks. Moreover, the current method for assessing the worst-case privacy risks of data records is time-consuming, limiting their practical applicability. To address these limitations, we introduce a novel membership inference game that can efficiently audit the approximate worst-case privacy risks of data records. Experimental results demonstrate that our method provides a more stringent measurement of group privacy risks, yielding a reliable assessment of the disparity in group privacy risks. Furthermore, to promote privacy protection fairness in DPML, we enhance the standard DP-SGD algorithm with an adaptive group-specific gradient clipping strategy, inspired by the design of canaries in differential privacy auditing studies. Extensive experiments confirm that our algorithm effectively reduces the disparity in group privacy risks, thereby enhancing the fairness of privacy protection in DPML.
Key Contributions
- A novel approximate worst-case membership inference game (MIG) that efficiently audits individual-level privacy risks with comparable accuracy to the computationally prohibitive leave-one-out attack (LOOA)
- A fairness metric quantifying inter-group disparity in privacy leakage risk under membership inference
- An adaptive group-specific gradient clipping extension to DP-SGD that reduces privacy risk disparity across demographic groups
🛡️ Threat Analysis
The paper introduces a novel membership inference game (MIG) as an auditing framework for measuring worst-case individual and group privacy leakage risks, and proposes a defense (adaptive gradient clipping in DP-SGD) specifically targeting membership inference vulnerability disparities across demographic groups.