  Differential privacy (DP) is typically formulated as a worst-case privacy
guarantee over all individuals in a database. More recently, extensions to
individual subjects or their attributes, have been introduced. Under the
individual/per-instance DP interpretation, we study the connection between the
per-subject gradient norm in DP neural networks and individual privacy loss and
introduce a novel metric termed the Privacy Loss-Input Susceptibility (PLIS),
which allows one to apportion the subject's privacy loss to their input
attributes. We experimentally show how this enables the identification of
sensitive attributes and of subjects at high risk of data reconstruction.
