Differential Privacy in Practice — Training Models That Don't Memorize
The theory of differential privacy is elegant; applying it to machine learning training is where it gets real. The key technique, DP-SGD, modifies the ordinary training loop so the resulting model carries a provable privacy guarantee — it demonstrably can't have memorized any individual's data too strongly. This post is about how differential privacy actually gets into a model, the knobs that control it, and the honest trade-offs that decide whether it's worth it.
DP-SGD modifies training — per-example gradient clipping plus calibrated noise, with privacy accounting across every data access — so the resulting model carries a provable guarantee it couldn't have memorized any individual. The knobs (ε, clipping, noise) and the honest costs (accuracy, fairness, compute).