Tempered Sigmoid Activations for Deep Learning with Differential Privacy

By Nicolas Papernot, Abhradeep Thakurta, Shuang Song, Steve Chien, Ú. Erlingsson. 2020

220 citations recorded by the source corpus.

Because learning sometimes involves sensitive data, machine learning algorithms have been extended to offer differential privacy for training data. In practice, this has been mostly an afterthought, with privacy-preserving models obtained by re-running training with a different optimizer, but using the model architectures that already performed well in a non-privacy-preserving setting. This approach leads to less than ideal privacy/utility tradeoffs, as we show here. To improve these tradeoffs, prior work introduces variants of differential privacy that weaken the privacy guarantee proved to increase model utility. We show this is not necessary and instead propose that utility be improved by choosing activation functions designed explicitly for privacy-preserving training. A crucial operation in differentially private SGD is gradient clipping, which along with modifying the optimization path (at times resulting in not-optimizing a single objective function), may also introduce both significant bias and variance to the learning process. We empirically identify exploding gradients arising from ReLU may be one of the main sources of this. We demonstrate analytically and experimentally how a general family of bounded activation functions, the tempered sigmoids, consistently outperform the currently established choice: unbounded activation functions like ReLU. Using this paradigm, we achieve new state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10 without any modification of the learning procedure fundamentals or differential privacy analysis. While the changes we make are simple in retrospect, the simplicity of our approach facilitates its implementation and adoption to meaningfully improve state-of-the-art machine learning while still providing strong guarantees in the original framework of differential privacy.

Subfields: Artificial Intelligence, Optimization & Training, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Optimization & Training

In Privacy & Security

Citations in the corpus

Practical and Private (Deep) Learning without Sampling or Shuffling (2021, methodology): “Differentially private stochastic gradient descent (DP-SGD) [1, 6, 67] has become state-of-the-art in training private (deep) learning models [1, 25, 27, 52, 57, 70].”
Differentially Private Learning Needs Better Features (or Much More Data) (2020, methodology): “For example, on CIFAR-10 we exceed the accuracy reported by Papernot et al. (2020b) while simultaneously improving the provable DP-guarantee by 130×.”
Selective Differential Privacy for Language Modeling (2021, background): “, 2019; Lee and Kifer, 2020) or model architecture (Papernot et al., 2020).”
Unlocking High-Accuracy Differentially Private Image Classification through Scale (2022, background): “Consequently, many works have focused either on developing specialized architectures for private training (Papernot et al., 2021; Tramèr and Boneh, 2021), or on reducing the dimensionality of the model during training (Golatkar et al., 2022; Yu et al., 2021b; Zhang et al., 2021; Zhou et al., 2021).”
Bounding Training Data Reconstruction in Private (Deep) Learning (2022, methodology): “We address the ﬁrst problem by replacing ReLU with the tanh activation function, which is smooth and has been recently found to be more suitable for private SGD training (Papernot et al., 2020).”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, methodology): “Papernot et al. (2020) argued that the choice of activation functions (e.g., RELU, sigmoid, etc.) has an important effect on DP model utility.”