A New Perspective on Differential Privacy: Using Information Theory to Quantify Lower Bounds on Model Reconstruction Attacks

The Overlooked Question: What Does DP-SGD Actually Protect Against?

Differential Privacy Stochastic Gradient Descent (DP-SGD) has become the de facto standard for training privacy-sensitive models. Its $(\varepsilon,\delta)$ guarantees are widely known — yet a more direct question has long gone unanswered: once an attacker obtains a model trained with DP-SGD, how much of the original data can they actually recover?

At its core, $(\varepsilon,\delta)$ is a probabilistic constraint on privacy loss, but it cannot directly tell us — for instance — whether an attacker can reconstruct the outline of a training image, or recover the genuinely sensitive features within it. This research addresses exactly that gap, proposing a framework for computing "reconstruction distortion bounds" that can be derived before training even begins.

An Exceptionally Strong Threat Model

The value of this work begins with the remarkably stringent threat model it assumes. The derived distortion bounds apply to a near-omniscient attacker who:

• Can observe the entire parameter trajectory throughout training — not just the final model;
• Knows all other training samples except the target record;
• Has access to the population distribution from which the training data was drawn.

Establishing a meaningful reconstruction error lower bound even under such powerful assumptions means the bound is truly "unavoidable" — no matter how sophisticated the attack algorithm, the expected reconstruction error cannot fall below this value. This stands in sharp contrast to most empirical attack evaluations, which can only characterize the effectiveness of a specific attack without offering any theoretical guarantee.

Core Idea: Separating Information Leakage from Data Uncertainty

The elegance of this framework lies in how it uses information theory to decompose reconstruction difficulty into two orthogonal sources:

Information Leaked During Training

The first component is the information about a target record leaked by the training process itself, measured via conditional mutual information (CMI). For DP-SGD, this leakage bound depends only on two hyperparameters: the sampling rate and the noise multiplier. This means the leakage upper bound can be estimated from configuration alone — before training starts.

Conditional Mutual Information (CMI) measures how much additional information about the target record is revealed by the parameter trajectory, given that all other training samples are already known. DP-SGD limits this leakage by adding Gaussian noise to gradients at each step. Intuitively, a higher noise multiplier and lower sampling rate make each training step less "aware" of any individual record, reducing cumulative leakage. Crucially, this leakage can be estimated directly from hyperparameters using privacy accounting techniques — such as the moments accountant or Rényi differential privacy — without running any actual attack experiments. This makes the leakage upper bound fully computable before model training, forming the foundation of the framework's "pre-training guarantee" property.

Inherent Uncertainty in the Data

The second component is the uncertainty already present in the data distribution itself, measured by source entropy. Even without any model leakage, an attacker must contend with the inherent randomness of the data. Source entropy can be lower-bounded with finite-sample confidence estimates from the data.

Rate-distortion theory then combines these two components to derive a lower bound on the expected error of any reconstruction attack. This decomposition is not only mathematically elegant — it also makes an intuitive point clear: reconstruction difficulty stems both from the privacy mechanism and from the inherent "fuzziness" of the data distribution itself.

Rate-Distortion Theory is a cornerstone of information theory, established by Shannon in 1959. It studies the minimum amount of information (rate) needed to describe a source given a tolerable level of reconstruction error (distortion). Its central result — the rate-distortion function R(D) — defines the fundamental tradeoff between rate and distortion that no encoding or reconstruction scheme can surpass. In this framework, "the amount of information an attacker can extract from the parameter trajectory about the target record" plays the role of rate, while reconstruction error corresponds to distortion. Once the available information is upper-bounded by the CMI, the rate-distortion function yields the corresponding lower bound on achievable distortion — meaning no matter how clever the attacker's algorithm, the expected error cannot be compressed below this threshold. This derivation directly bridges the probabilistic guarantees of differential privacy with interpretable perceptual error measures.

Letting Analysts Define What "Privacy-Sensitive" Means

A particularly practical design choice is that the error representation is chosen by the analyst. In other words, you can tailor the bound to focus specifically on the aspects of reconstruction that are genuinely privacy-sensitive for your application.

The researchers instantiated this framework in two spaces:

• Pixel space: traditional per-pixel error metrics;
• LPIPS feature space: a perceptual similarity metric.

According to the authors, this is the first lower bound on reconstruction distortion measured directly in LPIPS. Since LPIPS more closely mirrors human perception of image similarity, it provides more meaningful answers to the question of "can the attacker recover semantically identifiable content" than raw pixel error.

Furthermore, to ensure the bounds remain non-trivial on high-dimensional images, the work employs an orthogonal block construction, preventing the bounds from degenerating into vacuous results in high-dimensional settings.

LPIPS (Learned Perceptual Image Patch Similarity) is a perceptual image quality metric proposed by Zhang et al. in 2018 that measures image similarity using intermediate feature representations from deep neural networks. Unlike traditional pixel-level L2 error or PSNR, LPIPS scores align more closely with human visual judgments — two images with similar pixel values but different structure can yield a large LPIPS distance, while images with large pixel differences but similar semantics may have a small LPIPS distance. This property is especially significant in the context of privacy attack evaluation: what attackers truly care about is often whether they can recover a semantically recognizable face or lesion region, not pixel-level precision. Establishing a lower bound in LPIPS space means that even the strongest perceptual-level attacks have a theoretical floor on their expected error — a far more realistic characterization of privacy threats than pure pixel metrics.

Experiments: Bounds Remain Non-Trivial at Recommended Privacy Budgets

Across multiple image datasets, these lower bounds establish non-trivial, unavoidable expected reconstruction errors within — and well beyond — the privacy budget ranges recommended by industry heuristics. This is a significant finding: it demonstrates that under commonly used privacy configurations, there genuinely exist reconstruction protections that cannot be theoretically breached.

The study also compares the theoretical bounds against several strong reconstruction attacks and analyzes the primary sources of remaining "slack" between the bounds and actual attack performance. This comparison both validates the practical utility of the bounds and points toward directions for tightening them in future work.

Why This Work Deserves Attention

For years, a gap has persisted in the privacy protection field: abstract parameters like $(\varepsilon,\delta)$ are difficult to translate into concrete answers to questions like "is my data actually safe?" This research offers a bridge — it translates privacy budgets into interpretable, measurable, application-specific reconstruction error guarantees.

For teams deploying models in highly sensitive contexts such as medical imaging or facial recognition, a distortion lower bound that is computable before training, holds against worst-case attackers, and can be customized to specific sensitive features has direct engineering value. It shifts privacy evaluation from "post-hoc attack testing" to "pre-training verifiable guarantees."