← Reference notes

License: CC BY 4.0. Source: https://arxiv.org/abs/2503.13872

Summary

Faustini, Fernandes, McIver, and Dras look at how language-model papers report differential privacy. Training usually follows DP-SGD, and the privacy claim is a budget epsilon. They argue epsilon has no standalone meaning, so two methods cannot be ranked by comparing those numbers. Image work has used membership-inference attacks to put noise levels on a common scale. On text, they find membership inference barely helps that calibration, while attacks that try to reconstruct the hidden example are more informative. As a case study they define a directional, metric privacy mechanism from the von Mises-Fisher distribution: it perturbs the angle of a vector instead of adding the same Gaussian noise in every direction. Formal epsilons still cannot be lined up, but the empirical attacks show each mechanism winning on a different utility-versus-privacy slice. This note follows the abstract page only.

Why it is here

"Keep personal data safe" is not only a chatbot habit. When a model is trained on people's text, a published epsilon is easy to over-read. This paper says the number is not comparable across methods, and names reconstruction attacks as a more useful check than membership inference for language models.

@misc{iil_note_qnqxh580,
  author = {{iinventedlight Library}},
  title = {{Empirical Calibration and Metric Differential Privacy in Language Models}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-10-18},
  url = {https://iinventedlight.com/library/reference/arxiv/2503-13872-metric-differential-privacy-language-models/},
  note = {Permanent ID iil:note:qnqxh580. License: CC-BY-4.0. Summary of https://arxiv.org/abs/2503.13872.},
}

For language models and agents: start at /llms.txt. This page in Markdown: /library/reference/arxiv/2503-13872-metric-differential-privacy-language-models.md.