Model Explanations with Differential Privacy
- URL: http://arxiv.org/abs/2006.09129v1
- Date: Tue, 16 Jun 2020 13:18:02 GMT
- Title: Model Explanations with Differential Privacy
- Authors: Neel Patel, Reza Shokri, Yair Zick
- Abstract summary: Black-box machine learning models are used in critical decision-making domains.
Model explanations can leak information about the training data and the explanation data used to generate them.
We propose differentially private algorithms to construct feature-based model explanations.
- Score: 21.15017895170093
- License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
- Abstract: Black-box machine learning models are used in critical decision-making
domains, giving rise to several calls for more algorithmic transparency. The
drawback is that model explanations can leak information about the training
data and the explanation data used to generate them, thus undermining data
privacy. To address this issue, we propose differentially private algorithms to
construct feature-based model explanations. We design an adaptive
differentially private gradient descent algorithm, that finds the minimal
privacy budget required to produce accurate explanations. It reduces the
overall privacy loss on explanation data, by adaptively reusing past
differentially private explanations. It also amplifies the privacy guarantees
with respect to the training data. We evaluate the implications of
differentially private models and our privacy mechanisms on the quality of
model explanations.
Related papers
- Initialization Matters: Privacy-Utility Analysis of Overparameterized
Neural Networks [72.51255282371805]
We prove a privacy bound for the KL divergence between model distributions on worst-case neighboring datasets.
We find that this KL privacy bound is largely determined by the expected squared gradient norm relative to model parameters during training.
arXiv Detail & Related papers (2023-10-31T16:13:22Z) - Independent Distribution Regularization for Private Graph Embedding [55.24441467292359]
Graph embeddings are susceptible to attribute inference attacks, which allow attackers to infer private node attributes from the learned graph embeddings.
To address these concerns, privacy-preserving graph embedding methods have emerged.
We propose a novel approach called Private Variational Graph AutoEncoders (PVGAE) with the aid of independent distribution penalty as a regularization term.
arXiv Detail & Related papers (2023-08-16T13:32:43Z) - Differentially Private Synthetic Data Generation via
Lipschitz-Regularised Variational Autoencoders [3.7463972693041274]
It is often overlooked that generative models are prone to memorising many details of individual training records.
In this paper we explore an alternative approach for privately generating data that makes direct use of the inherentity in generative models.
arXiv Detail & Related papers (2023-04-22T07:24:56Z) - Why Is Public Pretraining Necessary for Private Model Training? [50.054565310457306]
We show that pretraining on publicly available data leads to distinct gains over nonprivate settings.
We argue that the tradeoff may be a deeper loss model that requires an algorithm to go through two phases.
Guided by intuition, we provide theoretical constructions that provably demonstrate the separation between private with and without public pretraining.
arXiv Detail & Related papers (2023-02-19T05:32:20Z) - Fine-Tuning with Differential Privacy Necessitates an Additional
Hyperparameter Search [38.83524780461911]
We show how carefully selecting the layers being fine-tuned in the pretrained neural network allows us to establish new state-of-the-art tradeoffs between privacy and accuracy.
We achieve 77.9% accuracy for $(varepsilon, delta)= (2, 10-5)$ on CIFAR-100 for a model pretrained on ImageNet.
arXiv Detail & Related papers (2022-10-05T11:32:49Z) - Mixed Differential Privacy in Computer Vision [133.68363478737058]
AdaMix is an adaptive differentially private algorithm for training deep neural network classifiers using both private and public image data.
A few-shot or even zero-shot learning baseline that ignores private data can outperform fine-tuning on a large private dataset.
arXiv Detail & Related papers (2022-03-22T06:15:43Z) - Don't Generate Me: Training Differentially Private Generative Models
with Sinkhorn Divergence [73.14373832423156]
We propose DP-Sinkhorn, a novel optimal transport-based generative method for learning data distributions from private data with differential privacy.
Unlike existing approaches for training differentially private generative models, we do not rely on adversarial objectives.
arXiv Detail & Related papers (2021-11-01T18:10:21Z) - Causally Constrained Data Synthesis for Private Data Release [36.80484740314504]
Using synthetic data which reflects certain statistical properties of the original data preserves the privacy of the original data.
Prior works utilize differentially private data release mechanisms to provide formal privacy guarantees.
We propose incorporating causal information into the training process to favorably modify the aforementioned trade-off.
arXiv Detail & Related papers (2021-05-27T13:46:57Z) - Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for
Private Learning [74.73901662374921]
A differentially private model degrades the utility drastically when the model comprises a large number of trainable parameters.
We propose an algorithm emphGradient Embedding Perturbation (GEP) towards training differentially private deep models with decent accuracy.
arXiv Detail & Related papers (2021-02-25T04:29:58Z) - Differentially Private Generation of Small Images [0.0]
We numerically measure the privacy-utility trade-off using parameters from $epsilon$-$delta$ differential privacy and the inception score.
Our experiments uncover a saturated training regime where an increasing privacy budget adds little to the quality of generated images.
arXiv Detail & Related papers (2020-05-02T10:37:46Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.