Private-kNN: Practical Differential Privacy for Computer Vision

By Yuqing Zhu, Xiang Yu, Manmohan Chandraker, Yu-Xiang Wang. 2020

81 citations recorded by the source corpus.

With increasing ethical and legal concerns on privacy for deep models in visual recognition, differential privacy has emerged as a mechanism to disguise membership of sensitive data in training datasets. Recent methods like Private Aggregation of Teacher Ensembles (PATE) leverage a large ensemble of teacher models trained on disjoint subsets of private data, to transfer knowledge to a student model with privacy guarantees. However, labeled vision data is often expensive and datasets, when split into many disjoint training sets, lead to significantly sub-optimal accuracy and thus hardly sustain good privacy bounds. We propose a practically data-efficient scheme based on private release of k-nearest neighbor (kNN) queries, which altogether avoids splitting the training dataset. Our approach allows the use of privacy-amplification by subsampling and iterative refinement of the kNN feature embedding. We rigorously analyze the theoretical properties of our method and demonstrate strong experimental performance on practical computer vision datasets for face attribute recognition and person reidentification. In particular, we achieve comparable or better accuracy than PATE while reducing more than 90% of the privacy loss, thereby providing the “most practical method to-date” for private deep learning in computer vision.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Zsolt Kira
2. Yen-Chang Hsu
3. Adam Dziedzic
4. Muhammad Ahmad Kaleem
5. James Smith
6. Y. Lu
7. Hongxia Jin
8. Yilin Shen

Citations in the corpus

• Always Be Dreaming: A New Approach for Data-Free Class-Incremental Learning (2021, background): “This is concerning for many computer vision applications because 1) Many computer vision applications are on-device and therefore memory constrained [17, 37, 54], and 2) Many computer vision applications learn from data which cannot be legally stored [6, 12, 64].”
• Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, background): “Such setting is known as Knowledge Transfer model [118], and it provides privacy with a great preservation of utility using voting based approaches [119, 120, 121].”
• Increasing the Cost of Model Extraction with Calibrated Proof of Work (2022, methodology): “In the case of a single model behind an ML API, we can also use a form of PATE proposed by Zhu et al. (2020).”
• Asynchronous Federated Learning on Heterogeneous Devices: A Survey (2021, background): “Prominent among these are the Laplace mechanism [37], exponential mechanism [39], and Gaussian mechanism [40].”