Amplified Patch-Level Differential Privacy for Free via Random Cropping

Kaan Durmaz; Jan Schuchardt; Sebastian Schmidt; Stephan Günnemann

cs.LGMar 25, 2026

Amplified Patch-Level Differential Privacy for Free via Random Cropping

Authors: Kaan Durmaz, Jan Schuchardt, Sebastian Schmidt, Stephan Günnemann

Organizations: Technical University of Munich · Machine Learning Research, Morgan Stanley

Abstract

Random cropping is one of the most common data augmentation techniques in computer vision, yet the role of its inherent randomness in training differentially private machine learning models has thus far gone unexplored. We observe that when sensitive content in an image is spatially localized, such as a face or license plate, random cropping can probabilistically exclude that content from the model's input. This introduces a third source of stochasticity in differentially private training with stochastic gradient descent, in addition to gradient noise and minibatch sampling. This additional randomness amplifies differential privacy without requiring changes to model architecture or training procedure. We formalize this effect by introducing a patch-level neighboring relation for vision data and deriving tight privacy bounds for differentially private stochastic gradient descent (DP-SGD) when combined with random cropping. Our analysis quantifies the patch inclusion probability and shows how it composes with minibatch sampling to yield a lower effective sampling rate. Empirically, we validate that patch-level amplification improves the privacy-utility trade-off across multiple segmentation architectures and datasets. Our results demonstrate that aligning privacy accounting with domain structure and additional existing sources of randomness can yield stronger guarantees at no additional cost.

Figures & tables

Figure 1: Illustration of the effect of random cropping on a private patch as the license plate (in red). Left: Original image with a designated private patch. Middle: A random crop that excludes the private patch. Right: A random crop that includes a part of the private patch. Any intersection allows the private patch to influence the output of the model.

Panel of Figure 2 — Figure 2: Privacy profiles for different mechanisms. DP-SGD with patch-level subsampling (blue) achieves stronger privacy amplification compared to standard minibatch subsampling (orange) with identical $\sigma=1$ . Even with an an extremely large noise scale $\sigma_{\text{data}}=1000$ , data-level noise addition (green) is less private.

Panel of Figure 5 — Figure 5: Model performance versus privacy-level $\varepsilon$ for DP-SGD with patch-level sampling (blue) and minibatch subsampling (orange). Results are averaged over four seeds; error bars show standard deviation. For Cityscapes, we use $\delta=1/2975$ , and for A2D2, $\delta=1/18557$ , following $\delta=1/\texttt{epoch\_size}$ . For both datasets a private patch size of $10\times 10$ is assumed. DG-SGD with patch-level privacy overperforms significantly, given the exact same setup.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 6 — Figure 6: Per-seed privacy-utility tradeoffs of DeepLabV3+ on Cityscapes. We assume a private patch size of $10\times 10$ , and set $\delta=1/2975$ .

Panel of Figure 7 — Figure 7: Per-seed privacy-utility tradeoffs of PSPNet on Cityscapes. We assume a private patch size of $10\times 10$ , and set $\delta=1/2975$ .

Panel of Figure 8 — Figure 8: Per-seed privacy-utility tradeoffs of PSPNet on A2D2. We assume a private patch size of $10\times 10$ , and set $\delta=1/18557$ .

Figure 9: Privacy-utility tradeoff on A2D2 with DeepLabV3+. Results averaged over four seeds, with error bars indicating standard deviation. We assume a private patch size of

10\times 10

, and set

\delta=1/18557

Panel of Figure 10 — Figure 10: Per-seed privacy-utility tradeoffs for A2D2 with DeepLabV3+. Three seeds converge and confirm the utility benefits of patch-level subsampling. Seed 516 diverged under both patch-level and minibatch subsampling. We assume a private patch size of $10\times 10$ , and set $\delta=1/18557$ .

Figure 11: Privacy-utility tradeoff comparing patch-level subsampling (blue), minibatch subsampling (orange), and Gaussian noise augmentation (green) for DeepLabV3+ and PSPNet on Cityscapes. Gaussian noise augmentation performs worse than both alternatives due to the high noise levels required for amplification.

\delta=1/2975

, private patch size

10\times 10

Figure 12: Privacy-utility tradeoff comparing patch-level subsampling (blue), minibatch subsampling (orange), and Gaussian noise augmentation (green) for DeepLabV3+ and PSPNet on A2D2. Gaussian noise augmentation performs worse than both alternatives due to the high noise levels required for amplification.

\delta=1/18557

, private patch size

10\times 10

Model	No Crop	Crop ( $10\times 10$ )
ResNet-18	99.4%	26.0%
VGG-11	99.2%	16.7%

Appendix

Table 1: MNIST accuracy without differential privacy (

\varepsilon=\infty

). Cropping alone destroys utility.

Figure 13: Model performance versus privacy-level

\varepsilon

for DP-SGD with patch-level sampling (blue) and minibatch subsampling (orange). Results are averaged over four seeds; error bars show standard deviation. We use

\delta=1/1879

, following

\delta=1/\texttt{epoch\_size}

and a private patch size of

5\times 5

is assumed. DG-SGD with patch-level privacy overperforms significantly, given the exact same setup.

Figure 14: Model performance versus privacy-level

\varepsilon

for DP-SGD with patch-level sampling (blue) and minibatch subsampling (orange). Results are averaged over four seeds; error bars show standard deviation. We use

\delta=1/60000

, following

\delta=1/\texttt{epoch\_size}

and a private patch size of

5\times 5

is assumed.

Panel of Figure 15 — Figure 15: Per-seed privacy-utility tradeoffs of ResNet-18 on DTD. We assume a private patch size of $5\times 5$ , and set $\delta=1/1879$ .

Panel of Figure 16 — Figure 16: Per-seed privacy-utility tradeoffs of VGG-11 on DTD. We assume a private patch size of $5\times 5$ , and set $\delta=1/1879$ .

Panel of Figure 17 — Figure 17: Privacy profiles for different mechanisms: DP-SGD with patch-level subsampling (blue), standard minibatch subsampling (orange), and data-level noise addition (green). We vary the noise levels $\sigma$ for the subsampling mechanisms, while keeping the data-level baseline fixed at $\sigma_{\text{data}}=1000$ .

Panel of Figure 18 — Figure 18: Privacy profiles for different mechanisms under varying private patch sizes: DP-SGD with patch-level subsampling (blue) and standard minibatch subsampling (orange) with identical $\sigma=1$ , and data-level noise addition (green) with $\sigma_{\texttt{data}}=1000$ .

Panel of Figure 19 — Figure 19: Privacy profiles for different mechanisms under varying crop sizes: DP-SGD with patch-level subsampling (blue) and standard minibatch subsampling (orange) with identical $\sigma=2$ , and data-level noise addition (green) with $\sigma_{\texttt{data}}=1000$ .

Panel of Figure 20 — Figure 20: Privacy profiles for different mechanisms under varying image resolutions: DP-SGD with patch-level subsampling (blue), standard minibatch subsampling (orange), and data-level noise addition (green). Crop size $200\times 200$ , private patch $20\times 20$ , $\sigma=2$ , $\sigma_{\text{data}}=1000$ .

Panel of Figure 21 — Figure 21: Privacy profiles for different mechanisms under varying data-level noise standard deviations: DP-SGD with patch-level subsampling (blue), standard minibatch subsampling (orange), and data-level noise addition (green). Crop size $200\times 200$ , private patch $20\times 20$ , $\sigma=2$ .

Panel of Figure 22 — Figure 22: Privacy profiles for different mechanisms: DP-SGD with patch-level subsampling (blue), standard minibatch subsampling (orange), and data-level noise addition (green). We vary the shapes of the private patches.

Panel of Figure 23 — Figure 23: $\varepsilon$ as a function of crop size (left) and private patch size (right), at $\delta=10^{-5}$ and image resolution $1000\times 1000$ for $\sigma\in\{1.0,1.5,2.0\}$ .

Panel of Figure 24 — Figure 24: $\varepsilon$ as a function of crop size (left) and private patch size (right), at $\delta=10^{-5}$ and image resolution $1000\times 1000$ for $\sigma\in\{2.5,3.0,3.5\}$ .

Panel of Figure 25 — Figure 25: $\varepsilon$ as a function of crop size (left) and private patch size (right), at $\delta=10^{-5}$ and image resolution $1000\times 1000$ for $\sigma\in\{4.0,4.5,5.0\}$ .

Panel of Figure 26 — Figure 26: $\varepsilon$ as a function of crop size (left) and private patch size (right), at $\delta=10^{-5}$ and image resolution $1000\times 2000$ for $\sigma\in\{1.0,1.5,2.0\}$ .

Panel of Figure 27 — Figure 27: $\varepsilon$ as a function of crop size (left) and private patch size (right), at $\delta=10^{-5}$ and image resolution $1000\times 2000$ for $\sigma\in\{2.5,3.0,3.5\}$ .

Panel of Figure 28 — Figure 28: $\varepsilon$ as a function of crop size (left) and private patch size (right), at $\delta=10^{-5}$ and image resolution $1000\times 2000$ for $\sigma\in\{4.0,4.5,5.0\}$ .

Panel of Figure 29 — Figure 29: $\varepsilon$ vs. padding amount for crop sizes (a) $400\times 400$ , (b) $450\times 450$ , (c) $500\times 500$ , with patch size $10\times 10$ and noise multipliers $\sigma\in\{4.0,4.5,5.0\}$ .

Panel of Figure 30 — Figure 30: $\varepsilon$ vs. padding amount for private patch sizes (a) $10\times 10$ , (b) $20\times 20$ , (c) $40\times 40$ , with crop size $500\times 500$ and noise multipliers $\sigma\in\{4.0,4.5,5.0\}$ .

Panel of Figure 31 — Figure 31: $\varepsilon$ vs. padding amount for noise values (a) $\sigma\in\{1.0,1.5,2.0\}$ , (b) $\sigma\in\{2.5,3.0,3.5\}$ , (c) $\sigma\in\{4.0,4.5,5.0\}$ , with crop size $500\times 500$ and private patch size $20\times 20$ .

Personalized Differential Privacy

See all 8 papers

Less Random, More Private: What is the Optimal Subsampling Scheme for DP-SGD?
May 8, 2026Andy Dong, Ayfer ÖzgürDifferentially Private Stochastic Gradient Descent Differential Privacy
Stanford University
Revisiting the Provable-Auditable Privacy Gap of DP-SGD
Aug 28, 2026Saloni Modi, Srivi Balaji, Yusong Zhu +2Differential Privacy Differentially Private Stochastic Gradient Descent
University of Texas at Austin · University of Waterloo and Vector Institute
SMA-DP: Spectral Memory-Aware Differential Privacy for Deep Learning
May 19, 2026Mohammad Partohaghighi, Roummel MarciaDeep Learning Optimization Differentially Private Stochastic Gradient Descent
Department of Electrical Engineering and Computer Science University of California, Merced Merced, CA, USA · Department of Applied Mathematics University of California, Merced Merced, CA, USA

May 8, 2026J/K move · Enter open · S save

Less Random, More Private: What is the Optimal Subsampling Scheme for DP-SGD?

Andy Dong, Ayfer Özgür

Stanford University

Differentially Private Stochastic Gradient Descent Differential Privacy

Open paper AskPDF arXiv

Poisson subsampling is the default sampling scheme in differentially private machine learning, largely because its unstructured randomness yields tractable privacy amplification analyses. Yet this same randomness introduces substantial participation variance: each sample appears in very different numbers of training iterations. In this work, we show that this variance is not merely a practical artifact to be tolerated, but a fundamental source of suboptimal privacy amplification. We prove that Balanced Iteration Subsampling (BIS), a structured scheme in which each sample participates in exactly a fixed number of iterations, achieves stronger privacy amplification than Poisson subsampling and is optimal at both extremes of the noise spectrum (

σ\to 0

and

σ\to \infty

). Our analysis reveals that the privacy-noise tradeoff is governed not by maximizing randomness, but by eliminating participation variance while preserving uniform marginal participation across iterations. To translate this asymptotic theory into finite-noise guarantees, we introduce a practical near-exact Monte Carlo accountant for BIS, which removes the analytical slack of existing RDP and composition-based PLD analyses. Evaluations across more than 60 practical DP-SGD configurations show that BIS consistently outperforms Poisson subsampling in the low-noise regimes most relevant for high-utility private training, reducing the required noise multiplier by up to

9.6\%

. These results overturn the common intuition that more sampling randomness necessarily yields stronger privacy amplification: in DP-SGD, structured participation can be both more practical and more private. Our implementation is available at https://github.com/dong-xin-ao-andy/bis-mc-accountant.

Abstract

Personalized Differential Privacy

Explore similar work

Less Random, More Private: What is the Optimal Subsampling Scheme for DP-SGD?

Revisiting the Provable-Auditable Privacy Gap of DP-SGD

SMA-DP: Spectral Memory-Aware Differential Privacy for Deep Learning