Deep Learning with Gaussian Differential Privacy.
Deep Learning with Gaussian Differential Privacy.
复制标题
DOI：
10.1162/99608f92.cfc5dd25
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Su WJ
中科院分区：
文献类型：
--
作者：
Bu Z;Dong J;Long Q;Su WJ
深度学习模型通常在包含个人购物交易、个人联系人和医疗记录等敏感信息的数据集上进行训练。因此，一个越来越重要的工作方向是试图训练受隐私约束的神经网络，这些隐私约束由差分隐私或其基于发散的松弛来指定。然而，这些隐私定义在处理某些重要的原语（组合和子采样）时存在弱点，从而对训练神经网络进行松散或复杂的隐私分析。在本文中，我们考虑最近提出的隐私定义称为f-差分隐私的训练神经网络的精细隐私分析。利用f-差分隐私在处理组合和子采样方面的吸引人的特性，本文推导出了用于训练深度神经网络的随机梯度下降和Adam的隐私保证的分析上易于处理的表达式，而不需要开发复杂的技术。我们的研究结果表明，f-差分隐私框架允许一种新的隐私分析，它改进了先前的分析，这反过来又建议在不违反隐私预算的情况下调整神经网络的某些参数，以获得更好的预测精度。这些理论推导的改进证实了我们的实验中的一系列任务，在图像分类，文本分类和推荐系统。用于计算这些实验的隐私成本的Python代码可在TensorFlow Privacy库中公开获得。
Deep learning models are often trained on datasets that contain sensitive information such as individuals’ shopping transactions, personal contacts, and medical records. An increasingly important line of work therefore has sought to train neural networks subject to privacy constraints that are specified by differential privacy or its divergence-based relaxations. These privacy definitions, however, have weaknesses in handling certain important primitives (composition and subsampling), thereby giving loose or complicated privacy analyses of training neural networks. In this paper, we consider a recently proposed privacy definition termed f-differential privacy for a refined privacy analysis of training neural networks. Leveraging the appealing properties of f-differential privacy in handling composition and subsampling, this paper derives analytically tractable expressions for the privacy guarantees of both stochastic gradient descent and Adam used in training deep neural networks, without the need of developing sophisticated techniques as did. Our results demonstrate that the f-differential privacy framework allows for a new privacy analysis that improves on the prior analysis, which in turn suggests tuning certain parameters of neural networks for a better prediction accuracy without violating the privacy budget. These theoretically derived improvements are confirmed by our experiments in a range of tasks in image classification, text classification, and recommender systems. Python code to calculate the privacy cost for these experiments is publicly available in the TensorFlow Privacy library.