TensorFlow Privacy is Google’s open-source library for training machine learning models with differential privacy, so models learn from data without memorizing individual training examples. It provides differentially private versions of TensorFlow optimizers (DP-SGD and friends), analysis tools that compute the privacy guarantees a training run actually achieved, and tutorials for applying them to real models. The library has around 2,000 GitHub stars and is under continual development, with updates pushed in 2026.
Differential privacy adds carefully calibrated noise during training and tracks a privacy budget (epsilon), giving a mathematical guarantee about how much any single person’s data can influence the model. TensorFlow Privacy makes this practical inside the TensorFlow/Keras ecosystem: swap in a DP optimizer, set your noise multiplier and clipping norm, and use the included Rényi DP accountants to report the resulting guarantee. Since version 0.9.0 the project ships as two PyPI packages, tensorflow-privacy and tensorflow-privacy-core style splits, separating the core accounting code from the TensorFlow integration.
Free. TensorFlow Privacy is open source under the Apache-2.0 license and installs from PyPI.
ML engineers and researchers training on sensitive data (health, finance, user behavior) who need provable privacy guarantees rather than best-effort anonymization.
TensorFlow Privacy is frequently used together with TensorFlow Federated and with DP implementations in JAX, and its maintainers publish guidance on choosing hyperparameters, since differential privacy always trades some model accuracy for stronger guarantees. The library’s accountants are also used as a reference by other frameworks when validating their own privacy computations, and the tutorials walk through end-to-end examples such as training a differentially private image classifier and language model.