Differentially Private Model Publishing for Deep Learning

By Lei Yu, Ling Liu, Calton Pu, Mehmet Emre Gursoy, Stacey Truex. 2019

296 citations recorded by the source corpus.

Deep learning techniques based on neural networks have shown significant success in a wide range of AI tasks. Large-scale training datasets are one of the critical factors for their success. However, when the training datasets are crowdsourced from individuals and contain sensitive information, the model parameters may encode private information and bear the risks of privacy leakage. The recent growing trend of the sharing and publishing of pre-trained models further aggravates such privacy risks. To tackle this problem, we propose a differentially private approach for training neural networks. Our approach includes several new techniques for optimizing both privacy loss and model accuracy. We employ a generalization of differential privacy called concentrated differential privacy(CDP), with both a formal and refined privacy loss analysis on two different data batching methods. We implement a dynamic privacy budget allocator over the course of training to improve model accuracy. Extensive experiments demonstrate that our approach effectively improves privacy loss accounting, training efficiency and model quality under a given privacy budget.

Subfields: Artificial Intelligence, Computer Science Applications, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Science Applications

In Privacy & Security

Citations in the corpus

Auditing Differentially Private Machine Learning: How Private is Private SGD? (2020, background): “Indeed a big part of making diﬀerentially private machine learning practical has been the signiﬁcant body of work giving progressively more reﬁned privacy analyses speciﬁcally for DP-SGD [ACG + 16, DRS19, MTZ19, YLP + 19], and for all we know these bounds on ε will continue to shrink.”
Privacy in Deep Learning: A Survey (2020, methodology): “w/ DNN Distributed DP [87] # # eICU, TCGA Classification w/ DNN DP model publishing [88] # # MNIST, CIFAR Image Classification w/ DNN DP federated learning [89] # # MNIST Image Classification w/ DNN ScalarDP, PrivUnit [90] # # MNIST, CIFAR Image Classification w/ DNN DSSGD [21] # # MNIST, SVHN Image”
Privacy-Preserving Tensor Factorization for Collaborative Health Data Analysis (2019, background): “DPFact tackles the privacy issue with a well-designed data-sharing strategy, combined with the rigorous zero-concentrated differential privacy (zCDP) technique [9, 34] which is a strictly stronger definition than (ε,δ )-differential privacy that is considered as the dominant standard for strong priv”
AdaCliP: Adaptive Clipping for Private SGD (2019, background): “Recently, [37, 38] proposed adaptive strategies to select privacy parameters ′, δ′ for each iteration.”
Security and Privacy Issues in Deep Learning (2018, background): “] TAPAS X [Sanyal et al. 2018] FHE-DiNN X [Bourse et al. 2018] DP-SGD X [Abadi et al. 2016b] DP LSTM X [McMahan et al. 2018] DPGAN X [Xie et al. 2018a] DPGM X [Acs et al. 2018] DP Model Publishing X [Yu et al. 2019] Privacy-preserving logistic regression X [Chaudhuri and Monteleoni 2009] dPA X [Phan”
When Relaxations Go Bad: "Differentially-Private" Machine Learning (2019, unknown): “We note that our gradient perturbation implementations require higher privacy budgets for achieving model accuracy compared to what was reported by Abadi et al. [1] and Yu et al. [77].”
MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples (2019, background): “Another line of defenses [1, 6, 12, 24, 30, 60, 66, 70] leverage differential privacy [13] when training the target classifier.”
DarkneTZ: towards model privacy at the edge using trusted execution environments (2020, methodology): “Nonetheless, recent work demonstrated that local models still leak private information [21, 33, 34, 47, 57, 61–63].”
Suicide Ideation Detection via Social and Temporal User Representations using Hyperbolic Learning (2021, background): “Future Practical Applicability In the future, we would want to focus on creating a differentially private public model that can be shared with the community while preserving user privacy (Lyu et al., 2020; Yu et al., 2019).”