Ilya Mironov
More info
- Affiliation
- Microsoft Research, Google, Meta
- Known for
- Rényi differential privacy, the floating-point attack, DP-SGD
The cryptographer who showed that differential privacy can leak through the least significant bits of a float, then helped make it practical for deep learning.
In 2012 Mironov published a paper that should have alarmed everyone who had ever implemented differential privacy. The Laplace noise meant to hide individual records was generated in floating point, and the pattern of which floats could actually occur gave away the exact value underneath. The maths was sound; the computer wasn't. His fix, the snapping mechanism, rounds outputs to a coarse grid.
In 2016 he co-authored the paper introducing DP-SGD, a way to train neural networks with SGD under privacy guarantees. The following year brought Rényi differential privacy, a variant that makes it far easier to add up the privacy budget across thousands of training steps. Both are now used almost everywhere models are trained under DP.