Adaptive Differentially Private Empirical Risk Minimization

Wu, Xiaofeng; Wang, Lingxiao; Cristali, Irina; Gu, Quanquan; Willett, Rebecca

doi:10.48550/arxiv.2110.07435

Cited by 4 publications

(7 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Bu et al [14] propose the automatic clipping (AUTO clipping) strategy, which replaces the traditional gradient clipping with normalization. Wu et al [15] propose an Adaptive Differentially Private Stochastic Gradient Descent (ADPSGD) algorithm, which adjusts the random noise added to the gradient by adaptive step size. Combining private learning with architectural search, Cheng et al [16] propose the DPNASNet model, which achieves a state-of-the-art privacy/utility trade-off.…”

Section: Related Workmentioning

confidence: 99%

“…The privacy budget k is the overall privacy budget allocated to all input features. According to Eq (15), the stronger relevant the region is, the more the privacy budget is allocated, and the less noise is added. This result is significant.…”

Section: Perturbation the Input Featuresmentioning

confidence: 99%

“…To verify the effectiveness of the AFRRS mechanism, the experiments were designed to compare TSA [10], BC [11], DPL-GGC [12], DP-PSAC [13], AUTO clipping [14], ADPSGD [15], DPNASNet [16], and the deep learning model without differential privacy protection (No DP). The results are shown in Table 3 and Table 4.…”

Section: Effectiveness Evaluation Of Different Algorithmsmentioning

confidence: 99%

“…The cause lies in the fact the more privacy budget means the weaker privacy guarantee, and less noise is injected into the model. [10] 66.20 7.53 BC [11] 74.00 3.64 DPL-GGC [12] 67.11 3.19 ADPSGD [15] 69.63 6.40 DPNASNet [16] 68.33 3.00 AFRRS 76.00 2.00…”

Section: Tablementioning

confidence: 99%

See 3 more Smart Citations

Preserving Differential Privacy in Deep Learning Based on Feature Relevance Region Segmentation

Wang

Xie

Tan

et al. 2024

IEEE Trans. Emerg. Topics Comput.

View full text Add to dashboard Cite

In the era of big data, deep learning techniques provide intelligent solutions for various problems in real-life scenarios. However, deep neural networks depend on large-scale datasets including sensitive data, which causes the potential risk of privacy leakage. In addition, various constantly evolving attack methods are also threatening the data security in deep learning models. Protecting data privacy effectively at a lower cost has become an urgent challenge. This paper proposes an Adaptive Feature Relevance Region Segmentation (AFRRS) mechanism to provide differential privacy preservation. The core idea is to divide the input features into different regions with different relevance according to the relevance between input features and the model output. Less noise is intentionally injected into the region with stronger relevance, and more noise is injected into the regions with weaker relevance. Furthermore, we perturb loss functions by injecting noise into the polynomial coefficients of the expansion of the objective function to protect the privacy of data labels. Theoretical analysis and experiments have shown that the proposed AFRRS mechanism can not only provide strong privacy preservation for the deep learning model, but also maintain the good utility of the model under a given moderate privacy budget compared with existing methods.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Perturbation the Input Featuresmentioning

confidence: 99%

Section: Effectiveness Evaluation Of Different Algorithmsmentioning

confidence: 99%

Section: Tablementioning

confidence: 99%

See 2 more Smart Citations

Preserving Differential Privacy in Deep Learning Based on Feature Relevance Region Segmentation

Wang

Xie

Tan

et al. 2024

IEEE Trans. Emerg. Topics Comput.

View full text Add to dashboard Cite

show abstract

“…Abadi et al (2016) propose a tight privacy accounting leading to a reasonable level of privacy cost for DP-SGD. Following that, variants of DP-SGD have been proposed to improve the model accuracy such as clipping based on quantiles (Andrew et al, 2019), dynamic noise power and clipping value (Du et al, 2021), and dynamic learning rate (Wu et al, 2021), etc. DP-SGD and its variants, on the other hand, have had limited success in large deep learning models due to their high computation cost, huge memory overhead, and significant performance drops.…”

Section: Related Workmentioning

confidence: 99%

DP-FP: Differentially Private Forward Propagation for Large Models

Du¹,

Mi²

2021

Preprint

View full text Add to dashboard Cite

When applied to large-scale learning problems, the conventional wisdom on privacypreserving deep learning, known as Differential Private Stochastic Gradient Descent (DP-SGD), has met with limited success due to significant performance degradation and high memory overhead when compared to the nonprivacy counterpart. We show how to mitigate the performance drop by replacing the DP-SGD with a novel DP Forward-Propagation (DP-FP) followed by an off-the-shelf non-DP optimizer. Our DP-FP employs novel (1) representation clipping followed by noise addition in the forward propagation stage, as well as (2) micro-batch construction via subsampling to achieve DP amplification and reduce noise power to 1/M , where M is the number of micro-batch in a step. When training a classification model, our DP-FP with all of the privacy-preserving operations on the representation is innately free of gradient bias, total noise proportionally to model size, and memory issues in DP-SGD. As a result, our DP-FP outperforms cutting-edge DP-SGD while retaining the same level of privacy, and it approaches non-private baselines and significantly outperforms state-of-the-art DP-SGD variants. When applied to RoBERTa-large on four downstream tasks, for example, DP-FP achieves an average accuracy of 91.34% with privacy budgets less than 3, representing a 3.81% performance improvement over the state-of-the-art DP-SGD and only a 0.9% loss compared to the non-private baseline but with a significantly lower privacy leakage risk.

show abstract

Differentially Private Learning with Per-Sample Adaptive Clipping

Xia

Shen

Yao

et al. 2023

AAAI

View full text Add to dashboard Cite

Privacy in AI remains a topic that draws attention from researchers and the general public in recent years. As one way to implement privacy-preserving AI, differentially private learning is a framework that enables AI models to use differential privacy (DP). To achieve DP in the learning process, existing algorithms typically limit the magnitude of gradients with a constant clipping, which requires carefully tuned due to its significant impact on model performance. As a solution to this issue, latest works NSGD and Auto-S innovatively propose to use normalization instead of clipping to avoid hyperparameter tuning. However, normalization-based approaches like NSGD and Auto-S rely on a monotonic weight function, which imposes excessive weight on small gradient samples and introduces extra deviation to the update. In this paper, we propose a Differentially Private Per-Sample Adaptive Clipping (DP-PSAC) algorithm based on a non-monotonic adaptive weight function, which guarantees privacy without the typical hyperparameter tuning process of using a constant clipping while significantly reducing the deviation between the update and true batch-averaged gradient. We provide a rigorous theoretical convergence analysis and show that with convergence rate at the same order, the proposed algorithm achieves a lower non-vanishing bound, which is maintained over training iterations, compared with NSGD/Auto-S. In addition, through extensive experimental evaluation, we show that DP-PSAC outperforms or matches the state-of-the-art methods on multiple main-stream vision and language tasks.

show abstract

Adaptive Differentially Private Empirical Risk Minimization

Cited by 4 publications

References 29 publications

Preserving Differential Privacy in Deep Learning Based on Feature Relevance Region Segmentation

Preserving Differential Privacy in Deep Learning Based on Feature Relevance Region Segmentation

DP-FP: Differentially Private Forward Propagation for Large Models

Differentially Private Learning with Per-Sample Adaptive Clipping

Contact Info

Product

Resources

About