Privacy for Free: How does Dataset Condensation Help Privacy?

Abstract

To prevent unintentional data leakage, research community has resorted to data generators that can produce differentially private data for model training. However, for the sake of the data privacy, existing solutions suffer from either expensive training cost or poor generalization performance. Therefore, we raise the question whether training efficiency and privacy can be achieved simultaneously. In this work, we for the first time identify that dataset condensation (DC) which is originally designed for improving training efficiency is also a better solution to replace the traditional data generators for private data generation, thus providing privacy for free. To demonstrate the privacy benefit of DC, we build a connection between DC and differential privacy, and theoretically prove on linear feature extractors (and then extended to non-linear feature extractors) that the existence of one sample has limited impact (O(m/n)) on the parameter distribution of networks trained on m samples synthesized from n(n m) raw samples by DC. We also empirically validate the visual privacy and membership privacy of DC-synthesized data by launching both the loss-based and the state-of-the-art likelihoodbased membership inference attacks. We envision this work as a milestone for data-efficient and privacy-preserving machine learning.

Federated Virtual Learning on Heterogeneous Data with Local-global Distillation

“…We also note the approach seems similar to the gradient inversion attack (Zhu et al, 2019) but we consider averaged gradients w.r.t. local virtual data, and the method potentially defenses inference attack better (Appendix Figure 13), which is also implied by (Xiong et al, 2022;Dong et al, 2022). Privacy preservation can be further improved by employing differential privacy (Abadi et al, 2016) in gradient sharing, but this is not the main focus of our work.…”

“…It brings in significantly improved the distillation efficiency. Moreover, recent studies have justified that data distillation also preserves privacy (Dong et al, 2022;Carlini et al, 2022b), which is critical in federated learning. Other modern data distillation strategies can be found here (Sachdeva & McAuley, 2023).…”

“…In MIA, the attackers have a list of query data, and the purpose is to determine whether the query data belongs to the original training set. As discussed in (Dong et al, 2022;Xiong et al, 2022), using distilled data to train a target model can defend against multiple attacks up to a certain level. We will especially apply MIA to test whether our work can defend against privacy attacks.…”

Improved Distribution Matching for Dataset Condensation

“…Dataset condensation aims to condense large datasets to smaller ones while preserving the information to train models. It can benefit various applications including continual learning [53,54,56], efficient neural architecture search [53,54,56], federated learning [17,41,59] and privacy-preserving ML [11,27]. Data Distillation (DD) [47] pioneered this topic by maximizing the accuracy of models trained by the condensed set with metalearning techniques [33].…”

Dataset Distillation via Factorization

“…However, the sheer amount of data introduces significant obstacles for storage, transmission, and data pre-processing. Besides, publishing raw data inevitably brings about privacy or copyright issue in practice [44,10]. To alleviate these problems, Wang et al [52] pioneer the research of dataset distillation (DD), to distill a large dataset into a synthetic one with only a limited number of samples, so that the training efforts with the distilled dataset for downstream models on the original dataset can be largely reduced, which facilitates a series of applications like continual learning [41,40,54,31] and black-box optimization [7].…”