Differentially Private Deep Learning with ModelMix

10/07/2022
by   Hanshen Xiao, et al.
0

Training large neural networks with meaningful/usable differential privacy security guarantees is a demanding challenge. In this paper, we tackle this problem by revisiting the two key operations in Differentially Private Stochastic Gradient Descent (DP-SGD): 1) iterative perturbation and 2) gradient clipping. We propose a generic optimization framework, called ModelMix, which performs random aggregation of intermediate model states. It strengthens the composite privacy analysis utilizing the entropy of the training trajectory and improves the (ϵ, δ) DP security parameters by an order of magnitude. We provide rigorous analyses for both the utility guarantees and privacy amplification of ModelMix. In particular, we present a formal study on the effect of gradient clipping in DP-SGD, which provides theoretical instruction on how hyper-parameters should be selected. We also introduce a refined gradient clipping method, which can further sharpen the privacy loss in private learning when combined with ModelMix. Thorough experiments with significant privacy/utility improvement are presented to support our theory. We train a Resnet-20 network on CIFAR10 with 70.4% accuracy via ModelMix given (ϵ=8, δ=10^-5) DP-budget, compared to the same performance but with (ϵ=145.8,δ=10^-5) using regular DP-SGD; assisted with additional public low-dimensional gradient embedding, one can further improve the accuracy to 79.1% with (ϵ=6.1, δ=10^-5) DP-budget, compared to the same performance but with (ϵ=111.2, δ=10^-5) without ModelMix.

READ FULL TEXT

page 1

page 2

page 3

page 4

research
03/29/2023

Have it your way: Individualized Privacy Assignment for DP-SGD

When training a machine learning model with differential privacy, one se...
research
06/06/2022

Per-Instance Privacy Accounting for Differentially Private Stochastic Gradient Descent

Differentially private stochastic gradient descent (DP-SGD) is the workh...
research
02/25/2021

Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning

The privacy leakage of the model about the training data can be bounded ...
research
07/07/2020

Bypassing the Ambient Dimension: Private SGD with Gradient Subspace Identification

Differentially private SGD (DP-SGD) is one of the most popular methods f...
research
05/25/2023

DP-SGD Without Clipping: The Lipschitz Neural Network Way

State-of-the-art approaches for training Differentially Private (DP) Dee...
research
03/08/2023

Differential Privacy Meets Neural Network Pruning

A major challenge in applying differential privacy to training deep neur...
research
10/15/2022

A Closer Look at the Calibration of Differentially Private Learners

We systematically study the calibration of classifiers trained with diff...

Please sign up or login with your details

Forgot password? Click here to reset