Deep Learning with Gaussian Differential Privacy

By Zhiqi Bu, Jinshuo Dong, Qi Long, Weijie Su. 2019

250 citations recorded by the source corpus.

Deep learning models are often trained on datasets that contain sensitive information such as individuals' shopping transactions, personal contacts, and medical records. An increasingly important line of work therefore has sought to train neural networks subject to privacy constraints that are specified by differential privacy or its divergence-based relaxations. These privacy definitions, however, have weaknesses in handling certain important primitives (composition and subsampling), thereby giving loose or complicated privacy analyses of training neural networks. In this paper, we consider a recently proposed privacy definition termed f-differential privacy [18] for a refined privacy analysis of training neural networks. Leveraging the appealing properties of f-differential privacy in handling composition and subsampling, this paper derives analytically tractable expressions for the privacy guarantees of both stochastic gradient descent and Adam used in training deep neural networks, without the need of developing sophisticated techniques as [3] did. Our results demonstrate that the f-differential privacy framework allows for a new privacy analysis that improves on the prior analysis [3], which in turn suggests tuning certain parameters of neural networks for a better prediction accuracy without violating the privacy budget. These theoretically derived improvements are confirmed by our experiments in a range of tasks in image classification, text classification, and recommender systems. Python code to calculate the privacy cost for these experiments is publicly available in the TensorFlow Privacy library.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Tempered Sigmoid Activations for Deep Learning with Differential Privacy (2020, background): “…improvements they provide compared to the alternative: the development of theoretical tools—such as new variants of the differential privacy definition that are better suited for deep learning (Bu et al. 2019)—is often a lengthy process and mandates that a privacy analysis be performed again.”
Privacy in Deep Learning: A Survey (2020, positive): “works [102, 103, 104, 95, 96, 105] all of which use perturbed gradients. More recently, Bu et al. apply the Gaussian Differential Privacy (GDP) notion introduced by Dong et al. [121] to deep learning [122] to achieve a more reﬁned analysis of neural network training, compared to that of Abadi et al.”
Privacy Regularization: Joint Privacy-Utility Optimization in LanguageModels (2021, methodology): “For the privacy accounting, we use Gaussian differential privacy (Bu et al., 2019).”
Bypassing the Ambient Dimension: Private SGD with Gradient Subspace Identification (2020, methodology): “[8] Zhiqi Bu, Jinshuo Dong, Qi Long, and Weijie J Su.”
Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, methodology): “[113] applies f-DP to a HFL setting, achieving a better privacy analysis than Abadi et al.”
TAN without a burn: Scaling Laws of DP-SGD (2022, background): “Bu et al. (2020) show that under the assumptions of the Central Limit Theorem, the Gaussian Differential Privacy (GDP) parameter of DP-SGD is q (cid:112) S (exp (1 /σ 2 ) − 1) .”
Differentially-private Federated Neural Architecture Search (2020, background): “and superior accuracy results than ( , δ)DP (Dong et al., 2019; Bu et al., 2019).”
Private Stochastic Non-Convex Optimization: Adaptive Algorithms and Tighter Generalization Bounds (2020, methodology): “[6] Zhiqi Bu, Jinshuo Dong, Qi Long, and Weijie J Su.”