Privacy for Free: Posterior Sampling and Stochastic Gradient Monte Carlo

By Yu-Xiang Wang, Stephen E. Fienberg, Alex Smola. 2015

259 citations recorded by the source corpus.

We consider the problem of Bayesian learning on sensitive datasets and present two simple but somewhat surprising results that connect Bayesian learning to "differential privacy", a cryptographic approach to protect individual-level privacy while permitting database-level utility. Specifically, we show that under standard assumptions, getting one sample from a posterior distribution is differentially private "for free"; and this sample as a statistical estimator is often consistent, near optimal, and computationally tractable. Similarly but separately, we show that a recent line of work that use stochastic gradient for Hybrid Monte Carlo (HMC) sampling also preserve differentially privacy with minor or no modifications of the algorithmic procedure at all, these observations lead to an "anytime" algorithm for Bayesian learning under privacy constraint. We demonstrate that it performs much better than the state-of-the-art differential private methods on synthetic and real datasets.

Subfields: Artificial Intelligence, Statistics and Probability, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Statistics and Probability

In Privacy & Security

Citations in the corpus

Differentially Private Summation with Multi-Message Shuffling (2019, background): “[9], Proposition 3) says that this suffices to conclude that our protocol is differentially private.”
Subsampled Rényi Differential Privacy and Analytical Moments Accountant (2018, methodology): “…private machine learning models is to use Stochastic Gradient Descent (SGD) with diﬀerentially private releases of (sometimes clipped) gradients evaluated on mini-batches of a dataset (Song et al., 2013; Bassily et al., 2014; Wang et al., 2015; Foulds et al., 2016; Abadi et al., 2016).”
Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences (2018, background): “…and it is not surprising that results quantifying the privacy ampliﬁcation obtained via subsampling play a key role in designing diﬀerentially private versions of these learning algorithms [Bassily et al., 2014, Wang et al., 2015, Abadi et al., 2016, Jälkö et al., 2017, Park et al., 2016b,a].”
Learning with Differential Privacy: Stability, Learnability and the Sufficiency and Necessity of ERM Principle (2015, background): “…naturally in the general framework of statistical machine learning, e.g., see (Dwork & Lei, 2009; Wasserman & Zhou, 2010; Smith, 2011; Lei, 2011; Wang et al., 2015), as well as applications involving regression (Chaudhuri et al., 2011; Thakurta & Smith, 2013) and GWAS data (Yu et al., 2014),…”
Differentially private subspace clustering (2015, background): “Note that this is closely related to earlier observation that “posterior sampling is private” [20, 6, 31], but different in that we constructed a model from a private procedure rather than the other way round.”
Entropy-SGD optimizes the prior of a PAC-Bayes bound: Generalization properties of Entropy-SGD and data-dependent priors (2017, background): “Given the connection between Gibbs posteriors and Bayesian posteriors, Entropy-SGLD also relates to the differential privacy of Bayesian and approximate sampling algorithms (Mir, 2013; Bassily et al., 2014; Dimitrakakis et al., 2014; Wang et al., 2015; Minami et al., 2016).”
Differentially Private Bayesian Linear Regression (2019, methodology): “…2009, Wang, 2018, Zhang et al., 2016], posterior sampling (OPS) [Dimitrakakis et al., 2014, Geumlek et al., 2017, Minami et al., 2016, Wang, 2018, Wang et al., 2015, Zhang et al., 2016], subsample and aggregate [Dwork and Smith, 2010, Smith, 2008], objective perturbation [Kifer et al., 2012],…”
White-box vs Black-box: Bayes Optimal Strategies for Membership Inference (2019, background): “Wang et al. (2015) show that Bayesian posterior sampling offers differential privacy guarantees.”
Profile-based Privacy for Locally Private Computations (2019, background): “A body of compelling results [4, 5, 13, 10, 18] have been achieved in the ”centralized” model, in which a trusted data curator has raw access to the data while performing the privacy-preserving operations.”
Collect at Once, Use Effectively: Making Non-interactive Locally Private Learning Possible (2017, background): “, 2016), machine learning (Chaudhuri & Monteleoni, 2008; Chaudhuri et al., 2011; Rubinstein et al., 2012; Wang et al., 2015), and statistical inference (Lei, 2011; Smith, 2011).”
Synthetic Data for Deep Learning (2019, unknown): “[632] to lead to DP guarantees.”
Privacy-preserving Analysis of Correlated Data (2016, background): “…et al., 2006), and there is a growing body of work on differentially private learning algorithms (Chaudhuri et al., 2011; Jain et al., 2012; Kifer et al., 2012; Chaudhuri et al., 2012; Hardt and Roth, 2013; Wang et al., 2015; Duchi et al., 2013; Bassily et al., 2014; Imtiaz and Sarwate, 2015).”
Concentrated Differentially Private Gradient Descent with Adaptive per-Iteration Privacy Budget (2018, background): “the case in practice; most of time optimization problems are solved approximately. Another approach that has gained popularity is the iterative gradient perturbation method [2, 23] and their variants [21, 22, 25]. Bassily et al. [2] proposed an (ϵ,δ)-differentially private version of stochastic grad”
Bayesian Inference for Large Scale Image Classification (2019, background): “Bayesian inference can also be applied to differential privacy, where each individual sample has increased privacy guarantees [2], and to reinforcement learning, where one can leverage model uncertainty to balance between exploration and exploitation [3].”