Towards Practical Differentially Private Convex Optimization

By Roger Iyengar, Joseph P. Near, Dawn Song, Om Thakkar, Abhradeep Thakurta, Lun Wang. 2019

203 citations recorded by the source corpus.

Building useful predictive models often involves learning from sensitive data. Training models with differential privacy can guarantee the privacy of such sensitive data. For convex optimization tasks, several differentially private algorithms are known, but none has yet been deployed in practice. In this work, we make two major contributions towards practical differentially private convex optimization. First, we present Approximate Minima Perturbation, a novel algorithm that can leverage any off-the-shelf optimizer. We show that it can be employed without any hyperparameter tuning, thus making it an attractive technique for practical deployment. Second, we perform an extensive empirical evaluation of the state-of-the-art algorithms for differentially private convex optimization, on a range of publicly available benchmark datasets, and real-world datasets obtained through an industrial collaboration. We release open-source implementations of all the differentially private convex optimization algorithms considered, and benchmarks on as many as nine public datasets, four of which are high-dimensional.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Privacy & Security, Mathematical Optimization

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Privacy & Security

In Mathematical Optimization

Citations in the corpus

Practical and Private (Deep) Learning without Sampling or Shuffling (2021, background): “Differentially private empirical risk minimization (ERM) and private online learning are well-studied areas in the privacy literature [1, 2, 3, 6, 7, 14, 29, 35, 37, 38, 43, 51, 57, 58, 65, 67, 68, 74]7.”
Privacy in Deep Learning: A Survey (2020, background): “in the scale of 2 n , and output perturbation requires sampling noise in the scale of 2 n , where nis the number of samples and is the regularization coefﬁcient [94]. More recently, Iyengar et al [120] propose a more practical and general objective perturbation approach, and benchmark it using high-”
Differentially Private Learning with Adaptive Clipping (2019, neutral): “In example-level DP, datasets are considered neighbors when they differ by the addition or removal of a single example (Chaudhuri et al., 2011; Bassily et al., 2014; Abadi et al., 2016b; Papernot et al., 2017; Wu et al., 2017; Papernot et al., 2018; Iyengar et al., 2019).”
Privacy Amplification by Iteration (2018, background): “The field of differentially private convex optimization spans almost a decade [15]–[27].”
Federated Learning: Challenges, Methods, and Future Directions (2019, methodology): “t distribution; this means that one cannot draw any conclusions about whether or not a speciﬁc sample is used in the learning process. Such sample-level privacy can be achieved in many learning tasks [2, 7, 22, 53, 85, 86]. For gradient-based learning methods, a popular approach is to apply differen”
Private Stochastic Convex Optimization with Optimal Rates (2019, background): “Related work: Differentially private empirical risk minimization (ERM) is a well-studied area spanning over a decade [CM08, CMS11, JKT12, KST12, ST13, SCS13, DJW13, Ull15, JT14, BST14, TTZ15, STU17, WLK + 17, WYX17, INS + 19].”
Measuring Forgetting of Memorized Training Examples (2022, background): “There is a large amount of theoretical work on differential privacy which designs algorithms specific to convex models, which do not apply to non-convex settings [12, 71, 34, 79].”
Membership Leakage in Label-Only Exposures (2020, background): “Many differential privacy-based defenses [11, 17, 26] involve clipping and adding noise to instance-level gradients and is designed to train a model to prevent it from memorizing training data or being susceptible to membership leakage.”
Individual Privacy Accounting via a Renyi Filter (2020, background): “[21], who report a non-private accuracy baseline of 84.”
Characterizing Private Clipped Gradient Descent on Convex Generalized Linear Problems (2020, unknown): “Over the past few years, there has been tremendous progress in differentially private convex empirical risk minimization (ERM) [9, 7, 38, 1, 6, 29, 44, 21, 33, 40, 15].”
Private stochastic convex optimization: optimal rates in linear time (2020, background): “In this case, the optimal statistical rate is O ( L 2 λn ) [HK14], and the private ERM can be optimized with an error of (cid:101) O ( dL 2 ε 2 λn 2 ).”
Disparate Vulnerability: on the Unfairness of Privacy Attacks Against Machine Learning (2019, methodology): “LR-AMP-DP uses the notation of Iyengar et al. [14].”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, background): “Several works attempted to remove the convergence to the global optimum requirement, for example (Iyengar et al., 2019) presented an alternative loss perturbation where privacy guarantees hold if the model reaches the vicinity of a global optimum, however the convexity remains a requirement.”
A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection (2019, background): “Many studies adopt differential privacy [35, 18, 9, 192, 208, 78, 104, 171] for data privacy protection, where the parties cannot know whether an individual record participates in the learning or not.”
MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples (2019, background): “Another line of defenses [1, 6, 12, 24, 30, 60, 66, 70] leverage differential privacy [13] when training the target classifier.”
When Machine Learning Meets Privacy (2020, methodology): “s for differential privacy ML. This technique adds a random linear term to the objective function. Objective perturbation has been extensively studied in convex optimization. Recently, Iyengar et al. [61] has provided a practical algorithm for differentially private convex optimization, which is a b”