Differentially Private Learning Needs Better Features (or Much More Data)

By Florian Tramèr, Dan Boneh. 2020

339 citations recorded by the source corpus.

We demonstrate that differentially private machine learning has not yet reached its "AlexNet moment" on many canonical vision tasks: linear models trained on handcrafted features significantly outperform end-to-end deep neural networks for moderate privacy budgets. To exceed the performance of handcrafted features, we show that private learning requires either much more private data, or access to features learned on public data from a similar domain. Our work introduces simple yet strong baselines for differentially private learning that can inform the evaluation of future progress in this area.

Subfields: Artificial Intelligence, Statistical Learning Theory, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Statistical Learning Theory

In Privacy & Security

Citations in the corpus

Practical and Private (Deep) Learning without Sampling or Shuffling (2021, background): “Differentially private stochastic gradient descent (DP-SGD) [1, 6, 67] has become state-of-the-art in training private (deep) learning models [1, 25, 27, 52, 57, 70].”
The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation (2021, methodology): “To address this issue, differential privacy (DP) (Dwork et al., 2006b), and in particular, DP-SGD can be employed (Song et al., 2013; Bassily et al., 2014; Abadi et al., 2016; Tramèr & Boneh, 2020).”
Evaluating Gradient Inversion Attacks and Defenses in Federated Learning (2021, methodology): “Recent works [Papernot et al., 2020, Tramèr and Boneh, 2021] suggest using better pre-training techniques and a large batch size (e.g. 4 , 096 ) to achieve a better accuracy for DPSGD training.”
Unlocking High-Accuracy Differentially Private Image Classification through Scale (2022, methodology): “However, the capacity of this model is limited – only reaching 71% in non-private training (Tramèr and Boneh, 2021), and thus the more expressive WRN models outperform it whenever ε ≥ 3.”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, background): “Tramèr & Boneh (2020) show that using handcrafted wavelet-like ScatterNet features improves the accuracy of DP-trained models.”
Differentially Private Fine-tuning of Language Models (2021, background): “Consequently, smaller and simpler private models achieve the better accuracy in several settings (Papernot et al., 2019; Tramèr and Boneh, 2021).”
Large Language Models Can Be Strong Differentially Private Learners (2021, background): “This assumption is that given a privacy budget, a “square-root” relationship holds between the noise multiplier and the sampling rate (see also (Tramèr & Boneh, 2020, Claim D.1)).”
TAN without a burn: Scaling Laws of DP-SGD (2022, background): “Tramer & Boneh (2020) show that handcrafted features are very competitive when training from scratch, but fine-tuning deep models outperforms them.”