Year: 2024
Type: conference-paper
Abstract: Machine learning models sometimes memorize sensitive training data features, posing privacy risks. To control such privacy risks, Dwork et al. proposed the definition of differential privacy (DP) to measure the privacy risks of an algorithm. However, existing DP models either have significantly lower accuracy than their non-private variants or are computationally expensive to train by requiring to incorporate a large amount of public prior knowledge in terms of data or a large pre-trained model. Thus, the fundamental problem of efficiently training an accurate model while preserving DP is not fully addressed. To tackle this problem, we investigate the potential of improving privacy analysis of machine learning algorithms, thus subsequently allowing improved privacy-utility trade-off. First, we observe that the standard DP bound is not tight for large, overparameterized models. Specifically, the DP bound worsens with the number of iterations, and the privacy-accuracy trade-off worsens with the model dimension. This is despite the algorithm converging during training and the finite dimension of training data space. Such potential untightness is more severe for a realistic adversary that does not observe all model parameters, where prior works suggest empirical privacy amplification, and we investigate theoretically. Finally, we take a close look at the privacy risk of each model prediction about individual training data and analyze how to attribute privacy risk to the properties of the data and the choice of model (e.g., architectures). If successful, our research would enable tighter and more informative privacy bounds for differentially private learning, thus in turn allowing improved privacy-utility trade-offs.
Author: Jiayuan Ye
Institution: National University of Singapore
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
OpenAlex ID: W4405181317