From Pixels to Privacy-Sensitive Features: An Information-Theoretic Framework for Reconstruction Bounds

What can an adversary recover from a model trained with DP-SGD? Its $(\varepsilon,δ)$ guarantee does not answer this question directly. We derive a distortion bound that can be computed before training and applies even to an adversary who observes the parameter trajectory during training, knows ever