Abstract
Random cropping is one of the most common data augmentation techniques in computer vision, yet the role of its inherent randomness in training differentially private machine learning models has thus far gone unexplored. We observe that when sensitive content in an image is spatially localized, such as a face or license plate, random cropping can probabilistically exclude that content from the model's input. This introduces a third source of stochasticity in differentially private training with stochastic gradient descent, in addition to gradient noise and minibatch sampling. This additional randomness amplifies differential privacy without requiring changes to model architecture or training procedure. We formalize this effect by introducing a patch-level neighboring relation for vision data and deriving tight privacy bounds for differentially private stochastic gradient descent (DP-SGD) when combined with random cropping. Our analysis quantifies the patch inclusion probability and shows how it composes with minibatch sampling to yield a lower effective sampling rate. Empirically, we validate that patch-level amplification improves the privacy-utility trade-off across multiple segmentation architectures and datasets. Our results demonstrate that aligning privacy accounting with domain structure and additional existing sources of randomness can yield stronger guarantees at no additional cost.
Abstract (translated)
随机裁剪是计算机视觉中最常见的数据增强技术之一，但其内在随机性在训练差分隐私机器学习模型中的作用迄今尚未被探索。我们观察到，当图像中的敏感内容（如面部或车牌）呈空间局部化分布时，随机裁剪可以概率性地将这些内容排除在模型输入之外。这为采用随机梯度下降进行差分隐私训练引入了除梯度噪声和小批量采样之外的第三种随机性来源。这种额外的随机性无需更改模型架构或训练流程即可增强差分隐私。我们通过引入视觉数据的块级邻近关系来形式化这一效应，并为结合随机裁剪的差分隐私随机梯度下降（DP-SGD）推导出紧致的隐私界限。我们的分析量化了块包含概率，并展示了其如何与小批量采样组合以产生更低的有效采样率。经验上，我们验证了块级增强在多个分割架构和数据集上改善了隐私-效用权衡。我们的结果表明，将隐私核算与领域结构及现有随机性来源对齐，可以无需额外成本地提供更强的保障。
URL
https://arxiv.org/abs/2603.24695
