An official website of the United States government
Differentially Private Stochastic Gradient Descent (DP-SGD) has become a widely used technique for safeguarding sensitive information in deep learning applications. Unfortunately, DP-SGDâs per-sample gradient clipping and uniform noise addition during training can significantly degrade model utility and fairness. We observe that the latest DP-SGD-Global-Adaptâs average gradient norm is the same throughout the training. Even when it is integrated with the existing linear decay noise multiplier, it has little or no advantage. Moreover, we notice that its upper clipping threshold increases exponentially towards the end of training, potentially impacting the modelâs convergence. Other algorithms, DP-PSAC, Auto-S, DP-SGD-Global, and DP-F, have utility and fairness that are similar to or worse than DP-SGD, as demonstrated in experiments. To overcome these problems and improve utility and fairness, we developed the DP-SGD-Global-Adapt-V2-S. It has a step-decay noise multiplier and an upper clipping threshold that is also decayed step-wise. DP-SGD-Global-Adapt-V2-S with a privacy budget of 1 improves accuracy by 0.9795%, 0.6786%, and 4.0130% in MNIST, CIFAR10, and CIFAR100, respectively. It also reduces the privacy cost gap by 89.8332% and 60.5541% in unbalanced MNIST and Thinwall datasets, respectively. Finally, we develop mathematical expressions to compute the privacy budget using truncated concentrated differential privacy (tCDP) for DP-SGD-Global-Adapt-V2-T and DP-SGD-Global-Adapt-V2-S.
more »
« less
Effectively using public data in privacy preserving Machine learning
Differentially private (DP) machine learning techniques are notorious for their degradation of model utility (e.g., they degrade classification accuracy). A recent line of work has demonstrated that leveraging public data can improve the trade-off between privacy and utility when training models with DP guaranteed. In this work, we further explore the potential of using public data in DP models, showing that utility gains can in fact be significantly higher than what shown in prior works. Specifically, we introduce DOPE-SGD, a modified DP-SGD algorithm that leverages public data during its training. DOPE-SGD uses public data in two complementary ways: (1) it uses advance augmentation techniques that leverages public data to generate synthetic data that is effectively embedded in multiple steps of the training pipeline; (2) it uses a modified gradient clipping mechanism (which is a standard technique in DP training) to change the origin of gradient vectors using the information inferred from available public and synthetic data, therefore boosting utility. We also introduce a technique to ensemble intermediate DP models by leveraging the post processing property of differential privacy to further improve the accuracy of the predictions. Our experimental results demonstrate the effectiveness of our approach in improving the state-of-the-art in DP machine learning across multiple datasets, network architectures, and application domains. For instance, assuming access to 2,000 public images, and for a privacy budget of ð=2,ð¿=10â5, our technique achieves an accuracy of 75.1 on CIFAR10, significantly higher than 68.1 achieved by the state of the art.
more »
« less
- Award ID(s):
- 2131938
- PAR ID:
- 10472949
- Editor(s):
- Andreas Krause, Emma Brunskill
- Publisher / Repository:
- ICML
- Date Published:
- Journal Name:
- Proceedings of the 40th International Conference on Machine Learning
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
To improve the quality of differentially private (DP) synthetic images, most studies have focused on improving core optimization techniques such as DP-SGD. Inspired by DP-FETA, this work proposes FETA-Pro, which introduces frequency features as training shortcuts. Their complexity lies between spatial features captured by central images and full images, enabling a finer-grained curriculum for DP training. FETA-Pro uses an auxiliary generator to produce images aligned with noisy frequency features, then trains another model with those images, spatial features, and DP-SGD. Across five sensitive image datasets, FETA-Pro achieves an average of 25.7% higher fidelity and 4.1% greater utility than the best-performing baseline at privacy budget epsilon = 1.more » « less
-
null (Ed.)Differential privacy (DP) is a popular mechanism for training machine learning models with bounded leakage about the presence of specific points in the training data. The cost of differential privacy is a reduction in the model's accuracy. We demonstrate that in the neural networks trained using differentially private stochastic gradient descent (DP-SGD), this cost is not borne equally: accuracy of DP models drops much more for the underrepresented classes and subgroups. For example, a gender classification model trained using DP-SGD exhibits much lower accuracy for black faces than for white faces. Critically, this gap is bigger in the DP model than in the non-DP model, i.e., if the original model is unfair, the unfairness becomes worse once DP is applied. We demonstrate this effect for a variety of tasks and models, including sentiment analysis of text and image classification. We then explain why DP training mechanisms such as gradient clipping and noise addition have disproportionate effect on the underrepresented and more complex subgroups, resulting in a disparate reduction of model accuracy.more » « less
-
Differential privacy (DP) is a popular mechanism for training machine learning models with bounded leakage about the presence of specific points in the training data. The cost of differential privacy is a reduction in the model's accuracy. We demonstrate that in the neural networks trained using differentially private stochastic gradient descent (DP-SGD), this cost is not borne equally: accuracy of DP models drops much more for the underrepresented classes and subgroups. For example, a gender classification model trained using DP-SGD exhibits much lower accuracy for black faces than for white faces. Critically, this gap is bigger in the DP model than in the non-DP model, i.e., if the original model is unfair, the unfairness becomes worse once DP is applied. We demonstrate this effect for a variety of tasks and models, including sentiment analysis of text and image classification. We then explain why DP training mechanisms such as gradient clipping and noise addition have disproportionate effect on the underrepresented and more complex subgroups, resulting in a disparate reduction of model accuracy.more » « less
-
ABSTRACT The increased application of machine learning (ML) in sensitive domains requires protecting the training data through privacy frameworks, such as differential privacy (DP). Traditional DP enforces a uniform privacy level , which bounds the maximum privacy loss that each data point in the dataset is allowed to incur. However, this oneâsizeâfitsâall approach fails to reflect the reality that individuals often have different privacy expectationsâdepending on factors such as the sensitivity of their data, legal requirements, or personal risk tolerance. As a result, uniform DP can either overprotect some data (hurting utility) or underprotect others (violating privacy needs). In this work, we introduce our PersonalizedâDP Output Perturbation method (PDPâOP) that enables us to train Ridge regression models withindividual per data pointprivacy levels, in the central privacy model. Our method relies on a technique known as output perturbation, that was introduced by Chaudhuri and Monteleoni, augmented with reâweighting data points according to their privacy levels. Additionally, we provide rigorous privacy proofs and accuracy guarantees for PDPâOP. Thereby, our work distinguishes itself by providing theoretical accuracy guarantees in personalized DP settings in ML, whereas similar previous work only provided empirical evaluations. To demonstrate how our theoretical bounds hold in practice, we evaluate PDPâOP on synthetic and real datasets and with diverse privacy distributions. We show that by enabling each data point to specify their own privacy requirement, we can significantly improve the privacyâaccuracy tradeâoffs compared to nonâpersonalized DP. Finally, we also show that PDPâOP outperforms the personalized privacy techniques introduced by Jorgensen et al. that rely on subsampling as opposed to reweighting.more » « less
