Unlocking High-Accuracy Differentially Private Image Classification through Scale

By Soham De, Leonard Berrada, Jamie Hayes, Samuel L. Smith, Borja Balle. 2022

286 citations recorded by the source corpus.

Differential Privacy (DP) provides a formal privacy guarantee preventing adversaries with access to a machine learning model from extracting information about individual training points. Differentially Private Stochastic Gradient Descent (DP-SGD), the most popular DP training method for deep learning, realizes this protection by injecting noise during training. However previous works have found that DP-SGD often leads to a significant degradation in performance on standard image classification benchmarks. Furthermore, some authors have postulated that DP-SGD inherently performs poorly on large models, since the norm of the noise required to preserve privacy is proportional to the model dimension. In contrast, we demonstrate that DP-SGD on over-parameterized models can perform significantly better than previously thought. Combining careful hyper-parameter tuning with simple techniques to ensure signal propagation and improve the convergence rate, we obtain a new SOTA without extra data on CIFAR-10 of 81.4% under (8, 10^{-5})-DP using a 40-layer Wide-ResNet, improving over the previous SOTA of 71.7%. When fine-tuning a pre-trained NFNet-F3, we achieve a remarkable 83.8% top-1 accuracy on ImageNet under (0.5, 8*10^{-7})-DP. Additionally, we also achieve 86.7% top-1 accuracy under (8, 8 \cdot 10^{-7})-DP, which is just 4.3% below the current non-private SOTA for this task. We believe our results are a significant step towards closing the accuracy gap between private and non-private image classification.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Privacy & Security

Citations in the corpus

Foundation Models and Fair Use (2023, background): “Recent works have developed substantial improvements to address this drawback through the use of better software primitives (Anil et al., 2021) and training techniques (Li et al., 2021; Yu et al., 2021; De et al., 2022; Sander et al., 2022).”
TAN without a burn: Scaling Laws of DP-SGD (2022, methodology): “We perform low compute hyper-parameter (HP) search at batch size 128 and extrapolate our best setup for a single run at large batch size: stars show our reproduction of the previous SOTA from (De et al., 2022) and improved performance obtained under the privacy budget ε = 8 with a +6 points gain in ”
Differentially Private Fine-tuning of Language Models (2021, methodology): “We show their setup can also improve the performance of our methods.”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, methodology): “De et al. (2022) however observe that for DP trained models, improvements in performance on training data are directly correlated to improvements on test data, hinting at reduced overfiting of DP-Trained models.”