DPAdapter: Improving Differentially Private Deep Learning through Noise
Tolerance Pre-training
- URL: http://arxiv.org/abs/2403.02571v1
- Date: Tue, 5 Mar 2024 00:58:34 GMT
- Title: DPAdapter: Improving Differentially Private Deep Learning through Noise
Tolerance Pre-training
- Authors: Zihao Wang, Rui Zhu, Dongruo Zhou, Zhikun Zhang, John Mitchell, Haixu
Tang, and XiaoFeng Wang
- Abstract summary: We introduce DPAdapter, a pioneering technique designed to amplify the model performance of DPML algorithms by enhancing parameter robustness.
Our experiments show that DPAdapter vastly enhances state-of-the-art DPML algorithms, increasing average accuracy from 72.92% to 77.09%.
- Score: 33.935692004427175
- License: http://creativecommons.org/licenses/by/4.0/
- Abstract: Recent developments have underscored the critical role of
\textit{differential privacy} (DP) in safeguarding individual data for training
machine learning models. However, integrating DP oftentimes incurs significant
model performance degradation due to the perturbation introduced into the
training process, presenting a formidable challenge in the {differentially
private machine learning} (DPML) field. To this end, several mitigative efforts
have been proposed, typically revolving around formulating new DPML algorithms
or relaxing DP definitions to harmonize with distinct contexts. In spite of
these initiatives, the diminishment induced by DP on models, particularly
large-scale models, remains substantial and thus, necessitates an innovative
solution that adeptly circumnavigates the consequential impairment of model
utility.
In response, we introduce DPAdapter, a pioneering technique designed to
amplify the model performance of DPML algorithms by enhancing parameter
robustness. The fundamental intuition behind this strategy is that models with
robust parameters are inherently more resistant to the noise introduced by DP,
thereby retaining better performance despite the perturbations. DPAdapter
modifies and enhances the sharpness-aware minimization (SAM) technique,
utilizing a two-batch strategy to provide a more accurate perturbation estimate
and an efficient gradient descent, thereby improving parameter robustness
against noise. Notably, DPAdapter can act as a plug-and-play component and be
combined with existing DPML algorithms to further improve their performance.
Our experiments show that DPAdapter vastly enhances state-of-the-art DPML
algorithms, increasing average accuracy from 72.92\% to 77.09\% with a privacy
budget of $\epsilon=4$.
Related papers
- Sparsity-Preserving Differentially Private Training of Large Embedding
Models [67.29926605156788]
DP-SGD is a training algorithm that combines differential privacy with gradient descent.
Applying DP-SGD naively to embedding models can destroy gradient sparsity, leading to reduced training efficiency.
We present two new algorithms, DP-FEST and DP-AdaFEST, that preserve gradient sparsity during private training of large embedding models.
arXiv Detail & Related papers (2023-11-14T17:59:51Z) - DPMLBench: Holistic Evaluation of Differentially Private Machine
Learning [8.568872924668662]
Many studies have recently proposed improved algorithms based on DP-SGD to mitigate utility loss.
More importantly, there is a lack of comprehensive research to compare improvements in these DPML algorithms across utility, defensive capabilities, and generalizability.
We fill this gap by performing a holistic measurement of improved DPML algorithms on utility and defense capability against membership inference attacks (MIAs) on image classification tasks.
arXiv Detail & Related papers (2023-05-10T05:08:36Z) - Towards the Flatter Landscape and Better Generalization in Federated
Learning under Client-level Differential Privacy [67.33715954653098]
We propose a novel DPFL algorithm named DP-FedSAM, which leverages gradient perturbation to mitigate the negative impact of DP.
Specifically, DP-FedSAM integrates Sharpness Aware of Minimization (SAM) to generate local flatness models with stability and weight robustness.
To further reduce the magnitude random noise while achieving better performance, we propose DP-FedSAM-$top_k$ by adopting the local update sparsification technique.
arXiv Detail & Related papers (2023-05-01T15:19:09Z) - Make Landscape Flatter in Differentially Private Federated Learning [69.78485792860333]
We propose a novel DPFL algorithm named DP-FedSAM, which leverages gradient perturbation to mitigate the negative impact of DP.
Specifically, DP-FedSAM integrates local flatness models with better stability and weight robustness, which results in the small norm of local updates and robustness to DP noise.
Our algorithm achieves state-of-the-art (SOTA) performance compared with existing SOTA baselines in DPFL.
arXiv Detail & Related papers (2023-03-20T16:27:36Z) - DPIS: An Enhanced Mechanism for Differentially Private SGD with
Importance Sampling [19.59757201902467]
differential privacy (DP) has become a well-accepted standard for privacy protection, and deep neural networks (DNN) have been immensely successful in machine learning.
A classic mechanism for this purpose is DP-SGD, which is a differentially private version of the gradient descent (SGD) commonly used for training.
We propose DPIS, a novel mechanism for differentially private SGD training that can be used as a drop-in replacement of the core of DP-SGD.
arXiv Detail & Related papers (2022-10-18T07:03:14Z) - DP-FP: Differentially Private Forward Propagation for Large Models [2.062295244789704]
We show how to mitigate the performance drop by replacing the Differential Private Gradient Descent with a novel DP Forward-Propagation (DP-FP)
Our DP-FP achieves an average accuracy of 91.34% with privacy budgets less than 3, representing a 3.81% performance improvement over the state-of-the-art DP-SGD.
arXiv Detail & Related papers (2021-12-29T07:32:29Z) - Neural Stochastic Dual Dynamic Programming [99.80617899593526]
We introduce a trainable neural model that learns to map problem instances to a piece-wise linear value function.
$nu$-SDDP can significantly reduce problem solving cost without sacrificing solution quality.
arXiv Detail & Related papers (2021-12-01T22:55:23Z) - Dynamic Differential-Privacy Preserving SGD [19.273542515320372]
Differentially-Private Gradient Descent (DP-SGD) prevents training-data privacy breaches by adding noise to the clipped gradient during SGD training.
The same clipping operation and additive noise across training steps results in unstable updates and even a ramp-up period.
We propose the dynamic DP-SGD, which has a lower privacy cost than the DP-SGD during updates until they achieve the same target privacy budget.
arXiv Detail & Related papers (2021-10-30T04:45:11Z) - Optimization-driven Machine Learning for Intelligent Reflecting Surfaces
Assisted Wireless Networks [82.33619654835348]
Intelligent surface (IRS) has been employed to reshape the wireless channels by controlling individual scattering elements' phase shifts.
Due to the large size of scattering elements, the passive beamforming is typically challenged by the high computational complexity.
In this article, we focus on machine learning (ML) approaches for performance in IRS-assisted wireless networks.
arXiv Detail & Related papers (2020-08-29T08:39:43Z) - Extrapolation for Large-batch Training in Deep Learning [72.61259487233214]
We show that a host of variations can be covered in a unified framework that we propose.
We prove the convergence of this novel scheme and rigorously evaluate its empirical performance on ResNet, LSTM, and Transformer.
arXiv Detail & Related papers (2020-06-10T08:22:41Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.