Privacy Odometers in Differential Privacy

• Privacy odometers are mechanisms in differential privacy that provide a time-uniform, high-probability upper bound on cumulative privacy loss without a fixed budget.
• They utilize martingale concentration inequalities to derive bounds—such as filter, mixture, and stitched odometers—with an intrinsic √lnln(n) overhead in adaptive settings.
• Practical implementations in deep learning and adaptive algorithm design demonstrate that privacy odometers enable dynamic tracking of privacy expenditure for real-world applications.

A privacy odometer is a formal mechanism within the theory of differential privacy that provides a time-uniform, high-probability upper bound on the cumulative privacy loss incurred by a sequence of (potentially adaptively chosen) differentially private mechanisms. Unlike privacy filters, which enforce a pre-specified privacy budget via a stopping rule, privacy odometers allow analysts to track privacy expenditure dynamically without the need to fix a budget in advance. This is critical for practical deployments where the number of data accesses and their privacy parameters may depend on previous computations' outcomes, settings where classical (fixed-parameter) composition theorems fall short. Privacy odometers provide mathematically rigorous, high-probability guarantees that, at every time step, the true cumulative privacy loss does not exceed the odometer's reading, except with a specified small failure probability.

1. Formal Definitions and Guarantee

A privacy odometer is defined relative to a target failure probability $\delta \in (0,1)$, a sequence of mechanisms $A_1, A_2, \ldots$ (each $(\epsilon_n, \delta_n)$-differentially private, possibly chosen adaptively based on previous outcomes), and neighboring databases $x \sim x'$. At each round $n$, the privacy loss random variable is

$$L_{1:n}(x, x') = \sum_{m=1}^n L_m(x, x'), \quad \text{where} \quad L_m(x, x') = \ln\frac{p_{m}(A_m(x)\mid A_{1:m-1}(x))}{p_{m}(A_m(x)\mid A_{1:m-1}(x'))}.$$

A family of deterministic functions $u_n$ defines the odometer readings $$U_n(x) = u_n(\epsilon_1(x), ..., \epsilon_{n-1}(x); \delta_1(x), ..., \delta_{n-1}(x))$$. The sequence $(u_n)_{n \geq 1}$ is a $\delta$-privacy odometer if, for every $A_1, A_2, \ldots$0,

$A_1, A_2, \ldots$1

That is, with probability at least $A_1, A_2, \ldots$2, the true privacy loss never exceeds the instantaneous odometer reading at any step (Rogers et al., 2016, Whitehouse et al., 2022).

2. Odometer Bounds and Constructions

Recent work, notably Whitehouse et al. (Whitehouse et al., 2022), provides several odometer constructions with varying tightness of their bounds and dependencies on the adaptivity of parameters. Assuming each mechanism $A_1, A_2, \ldots$3 is $A_1, A_2, \ldots$4-pointwise DP conditioned on the past, they define $A_1, A_2, \ldots$5. For a total allowable failure $A_1, A_2, \ldots$6, principal odometer forms are:

• Filter odometer: Matches the classical advanced composition bound at a chosen $A_1, A_2, \ldots$7. The guarantee is

$A_1, A_2, \ldots$8

where $A_1, A_2, \ldots$9 provides the same leading constants as advanced composition (Whitehouse et al., 2022).

• Mixture odometer: Valid for all $(\epsilon_n, \delta_n)$0 simultaneously, providing a bound of order $(\epsilon_n, \delta_n)$1, derived via the method of mixtures for martingale concentration.
• Stitched odometer: Achieves the optimal asymptotic rate $(\epsilon_n, \delta_n)$2 via a stitching argument, which closely matches the law of the iterated logarithm for sums of bounded random variables.

All above guarantee, simultaneously for all $(\epsilon_n, \delta_n)$3, that the realized privacy loss stays beneath the associated odometer with probability $(\epsilon_n, \delta_n)$4.

A foundational result in (Rogers et al., 2016) demonstrates that, in the adaptive-parameter setting, privacy odometers must pay an extra factor of $(\epsilon_n, \delta_n)$5 in the cumulative loss comparison to filters or nonadaptive advanced composition. Thus, odometers provide nearly tight adaptive composition, but with an unavoidable, though slowly growing, overhead.

3. Martingale-Based Analysis and Proof Techniques

The derivation of privacy odometers is grounded in martingale concentration inequalities. The privacy-loss martingale is

$(\epsilon_n, \delta_n)$6

with the filtration $(\epsilon_n, \delta_n)$7 determined by the history of $(\epsilon_n, \delta_n)$8.

Key technical steps (Whitehouse et al., 2022, Rogers et al., 2016):

• The one-step conditional expectation is bounded as $(\epsilon_n, \delta_n)$9.
• Uniform (over time) concentration of the privacy-loss martingale is obtained by advanced tools:
  • Line-crossing bounds: Provide explicit expressions for the maximal excursion of the martingale, yielding the filter odometer.
  • Mixture and stitching bounds: Further refine tail decay at the expense of iterated logarithmic factors in the bound, enabling tight, time-uniform guarantees.

These techniques replace earlier combinatorial or moment-based arguments and allow for sharp, implementation-friendly bounds when privacy parameters are chosen adaptively.

4. Advanced Composition and Performance Comparison

The classical advanced composition result states that composing $x \sim x'$0 $x \sim x'$1-DP mechanisms achieves $x \sim x'$2-DP with

$x \sim x'$3

For small $x \sim x'$4, the second term is $x \sim x'$5. In the nonadaptive case, privacy filters or filters can match this bound exactly (up to constants), while privacy odometers, which cannot "refuse" output, must suffer the $x \sim x'$6 overhead. This formal separation is proved in (Rogers et al., 2016), affirming that any valid odometer in this setting must incur this additional term, while filters or nonadaptive composition can avoid it.

Empirical evaluation in deep learning (Lécuyer, 2021) shows that RDP-based odometers with improved constants report realized $x \sim x'$7 up to $x \sim x'$8–$x \sim x'$9 lower than previous constructions, making them practical for adaptive algorithm design.

5. Rényi Differential Privacy Odometers

The odometer concept readily extends to Rényi Differential Privacy (RDP) (Lécuyer, 2021), which offers additive composition for orders $n$0. For $n$1-RDP mechanisms, composing adaptively chosen steps summing to $n$2 results in $n$3-RDP.

In this setting, the RDP odometer maintains a collection of exponentially growing privacy budgets indexed by $n$4, with each "bucket" $n$5 of the form $n$6 where $n$7. The odometer reading after $n$8 steps is

$n$9

and, as in the classical setting, this provides a high-probability upper bound, accounting for the adaptivity in the privacy parameters.

Notably, the RDP odometer incurs only an additive, logarithmic-in-$$L_{1:n}(x, x') = \sum_{m=1}^n L_m(x, x'), \quad \text{where} \quad L_m(x, x') = \ln\frac{p_{m}(A_m(x)\mid A_{1:m-1}(x))}{p_{m}(A_m(x)\mid A_{1:m-1}(x'))}.$$0 penalty compared to the strong-composition rate, with no adaptivity overhead in the filter version.

6. Practical Implementation, Use Cases, and Experimental Insights

Practical deployment of privacy odometers relies on their ability to dynamically report privacy usage, making them suitable for scenarios such as adaptive noise or batch-size tuning during deep learning training, and early-stopping algorithms to conserve the privacy budget (Lécuyer, 2021, Whitehouse et al., 2022).

A typical implementation maintains a summary of the cumulant privacy loss statistics (e.g., $$L_{1:n}(x, x') = \sum_{m=1}^n L_m(x, x'), \quad \text{where} \quad L_m(x, x') = \ln\frac{p_{m}(A_m(x)\mid A_{1:m-1}(x))}{p_{m}(A_m(x)\mid A_{1:m-1}(x'))}.$$1 for DP or $$L_{1:n}(x, x') = \sum_{m=1}^n L_m(x, x'), \quad \text{where} \quad L_m(x, x') = \ln\frac{p_{m}(A_m(x)\mid A_{1:m-1}(x))}{p_{m}(A_m(x)\mid A_{1:m-1}(x'))}.$$2 for RDP), updating the odometer reading efficiently using bucketed structures for high-frequency queries.

Experiments on DP-SGD for CIFAR-10 classification demonstrate that privacy odometers enable:

• Adaptive algorithm design (e.g., dynamically tuning noise or batch size for improved accuracy at fixed $$L_{1:n}(x, x') = \sum_{m=1}^n L_m(x, x'), \quad \text{where} \quad L_m(x, x') = \ln\frac{p_{m}(A_m(x)\mid A_{1:m-1}(x))}{p_{m}(A_m(x)\mid A_{1:m-1}(x'))}.$$3);
• Early halting, saving privacy budget when further training yields diminishing returns;
• Substantially tighter $$L_{1:n}(x, x') = \sum_{m=1}^n L_m(x, x'), \quad \text{where} \quad L_m(x, x') = \ln\frac{p_{m}(A_m(x)\mid A_{1:m-1}(x))}{p_{m}(A_m(x)\mid A_{1:m-1}(x'))}.$$4-accounting relative to previous adaptive tools, translating into greater utility for given privacy standards.

7. Fundamental Limitations and Theoretical Separation from Filters

A principal limitation, established by Rogers et al. (Rogers et al., 2016), is that privacy odometers must suffer an additional $$L_{1:n}(x, x') = \sum_{m=1}^n L_m(x, x'), \quad \text{where} \quad L_m(x, x') = \ln\frac{p_{m}(A_m(x)\mid A_{1:m-1}(x))}{p_{m}(A_m(x)\mid A_{1:m-1}(x'))}.$$5 factor compared to privacy filters or nonadaptive advanced composition. This gap is intrinsic and arises from the impossibility (proved via an anti-concentration argument) of producing an odometer bound that uniformly matches the advanced composition rate for all adversarial stopping-time strategies. By contrast, privacy filters can always enforce the advanced composition budget (up to constants) by halting future computations once the cumulative loss meets the enforced threshold.

This theoretical separation underlines the necessity of choosing between the flexibility of pay-as-you-go privacy accounting (odometers) and the tightness of fixed-budget accounting (filters), with the former optimal for interactive, open-ended analyses and the latter for pre-specified query regimes.

---

References

• Rogers, Roth, Smith, Thakurta. "Privacy Odometers and Filters: Pay-as-you-Go Composition" (Rogers et al., 2016)
• Whitehouse, Steinke, Bun, et al. "Fully Adaptive Composition in Differential Privacy" (Whitehouse et al., 2022)
• Feldman, Zrnic. "Practical Privacy Filters and Odometers with Rényi Differential Privacy and Applications to Differentially Private Deep Learning" (Lécuyer, 2021)