Balls-and-Bins sampling improves DP-SGD privacy and utility.
problem Improving privacy and utility in DP-SGD implementations.
method Introducing Balls-and-Bins sampling as an alternative to shuffling in DP-SGD.
result Balls-and-Bins sampling achieves utility comparable to shuffling while offering better privacy amplification.
This work improves privacy-generalization bounds for DP-SGD.
problem Understanding the trade-off between privacy and generalization in machine learning.
method Proved a linear max-information bound for DP-SGD, derived PAC-Bayes and generalization bounds.
result Explicit and controlled complexity terms for DP-SGD-trained models.
DP-SGD analysis shows many datapoints leak less privacy than previously thought.
problem Empirical evidence suggests DP-SGD leaks less privacy than current analysis predicts.
method Developed a per-instance DP analysis of DP-SGD, introducing dependence on dataset distribution.
result Formally shows DP-SGD leaks significantly less privacy for many datapoints on common benchmarks.
Paper bridges statistical inference for DP-SGD, a privacy-preserving machine learning method.
problem Asymptotic statistical inference for Differentially Private Stochastic Gradient Descent (DP-SGD).
method Established asymptotic properties of SGD under randomized subsampling, extended to DP-SGD, proposed methods for constructing valid confidence intervals.
result Valid confidence intervals for DP-SGD output achieve nominal coverage rates while maintaining privacy.
Large batch training with DP-SGD reduces model performance due to implicit bias.
problem Large batch training with DP-SGD reduces model performance.
method The study analyzes the phenomenon of implicit bias in Noisy-SGD (DP-SGD without clipping) and its theoretical solutions for linear models.
result The implicit bias in large batch training with DP-SGD is amplified by additional noise, similar to SGD.
Large batch sizes reduce gradient variance in DP-SGD, improving privacy.
problem Understanding why large batch sizes work in DP-SGD.
method Decomposed total gradient variance into subsampling and noise-induced variances, proving batch size independence in the limit.
result Large batch sizes reduce effective total gradient variance, improving privacy in DP-SGD.
Proactive DP optimizes privacy and utility in DP-SGD with a fixed privacy budget.
problem Balancing privacy and utility in differential privacy for machine learning.
method Proposes a pro-active DP framework that allows a-priori selection of DP-SGD parameters to maximize test accuracy.
result Proactive DP can optimize utility of DP-SGD with a fixed privacy budget (ε, δ).
DP-RandP improves privacy-utility tradeoff in DP-SGD by learning priors from random processes.
problem Improving the performance of differentially private stochastic gradient descent (DP-SGD) on private data.
method A three-phase approach that learns priors from images generated by random processes and transfers these priors to private data.
result New state-of-the-art accuracy on CIFAR10, CIFAR100, MedMNIST, and ImageNet for various privacy budgets.
DPDMs use DP-SGD to generate private synthetic data.
problem Generating private synthetic data from sensitive datasets.
method Introduced DP-SGD for DMs, investigated DM parameterization and sampling, proposed noise multiplicity.
result Achieved state-of-the-art performance in image generation benchmarks.
DP-SGD provides privacy guarantees for all data points, but we propose output-specific DP to better account for individual examples.
problem Accounting for individual privacy guarantees in DP-SGD.
method Output-specific ( ε , δ ) (\varepsilon,δ) ( ε , δ ) -DP and an efficient algorithm to investigate individual privacy across datasets. result Most examples enjoy stronger privacy guarantees than the worst-case bound, and there is a correlation between training loss and privacy parameter.
New DP-CD method outperforms DP-SGD in solving composite DP-ERM problems.
problem Privacy-preserving machine learning with differential privacy.
method Differentially Private proximal Coordinate Descent (DP-CD) for composite Empirical Risk Minimization (ERM).
result DP-CD outperforms DP-SGD due to larger step sizes and better gradient exploitation.
Projective DP-SGD reduces privacy error by identifying low-dimensional gradient subspaces.
problem Differentially private SGD's error rate scales with model's dimensionality, problematic for over-parameterized models.
method Projective DP-SGD, projecting noisy gradients to a low-dimensional subspace identified from a public dataset.
result The method reduces the dependence on model dimensionality, improving accuracy in high privacy regimes.
DP-SGD can update fewer coordinates while maintaining privacy.
problem How to update fewer coordinates in DP-SGD without losing optimization signal.
method TP-TopK (Two-Phase TopK DP-SGD), a two-phase method for coordinate-sparse private training.
result Private training can update fewer coordinates without losing optimization signal, scaling noise with active dimension \(k\) instead of full dimension \(d\).
Improved DP-SGD on large models achieves high accuracy on image classification tasks.
problem Differentially private image classification often degrades performance.
method Careful hyper-parameter tuning and signal propagation techniques.
result Achieved 81.4% top-1 accuracy on CIFAR-10 under (8, 10^{-5})-DP.
This work analyzes DP-SGD for online LDP problems with practical convergence rates.
problem Analyzing DP-SGD for online LDP problems with practical convergence rates.
method Developed a general framework for online LDP model in stochastic optimization problems, conducted non-asymptotic convergence analysis.
result Comprehensive non-asymptotic convergence analysis of the proposed estimators in finite-sample situations.
Expands differential privacy mechanisms to include the Generalized Gaussian mechanism for improved private machine learning.
problem Improving privacy in machine learning algorithms while maintaining utility.
method Introduces and analyzes the Generalized Gaussian (GG) mechanism for differential privacy.
result The GG mechanism provides better performance than the Laplace and Gaussian mechanisms across various values of β.
New method amplifies privacy in decentralized learning without centralized communication.
problem Privacy amplification in decentralized federated learning.
method Random check-in protocol for DP-SGD in FL.
result Privacy/accuracy trade-offs similar to subsampling/shuffling, but without server-initiated communication.
This paper benchmarks privacy-preserving machine learning on medical images.
problem Ensuring privacy in medical image analysis while maintaining model accuracy.
method Comparing Local-DP and DP-SGD for differential privacy in medical imagery.
result Theoretical privacy guarantees do not fully align with real-world performance.
New method for differentially private optimization with general Lipschitz conditions.
problem Differentially private optimization under general Lipschitz conditions.
method Generalized Lipschitz condition for per-sample gradients, tuning clip norm based on minimum per-sample Lipschitz constant.
result Efficacy of the recommended clip norm tuning method verified on 8 datasets.
New privacy bounds for DP-SGD's last iterate, even with cyclic sampling.
problem Privacy of the last iterate in DP-SGD with cyclic sampling.
method Established new RDP upper bounds for the last iterate under realistic assumptions.
result Privacy bounds for DP-SGD's last iterate with cyclic sampling and clipping, even for nonconvex losses.
New sampling scheme improves privacy in DP-SGD without sacrificing utility.
problem Suboptimal privacy amplification due to participation variance in Poisson subsampling.
method Balanced Iteration Subsampling (BIS) with structured randomness.
result BIS achieves stronger privacy amplification than Poisson subsampling and is optimal at both extremes of noise spectrum.
New method optimizes privacy and compute trade-offs for deep learning.
problem Privacy and compute trade-offs in deep learning training.
method Decoupling privacy analysis and experimental behavior, using TAN and scaling laws for DP-SGD.
result Stronger privacy guarantees with significant reduction in computational budget.
The paper proposes a method to learn differentially private variational autoencoders with term-wise gradient aggregation.
problem Learning variational autoencoders with differential privacy constraints and multiple divergences.
method Term-wise Differentially Private SGD (DP-SGD) that crafts randomized gradients for each loss term, keeping sensitivity at O(1).
result The method reduces the amount of noise needed for differential privacy, allowing better learning.
Improved privacy analysis for stochastic gradient descent.
problem Analyzing privacy leakage in noisy stochastic gradient descent.
method Modeling Rényi divergence dynamics with Langevin diffusions, proving exponential privacy loss convergence for smooth and strongly convex objectives.
result Privacy loss converges exponentially fast for smooth and strongly convex objectives under constant step size.
Differentially private learning avoids iterative optimization in parameter space.
problem Differentially private training of neural networks
method Hypernetworks trained on public datasets
result Significantly reduces noise in parameter space
Paper proposes DP-SGD and DP-NSGD for differentially private non-convex optimization.
problem Mitigating privacy risks in large model learning.
method Clip or normalize per-sample gradients and add noise for differential privacy.
result Achieved convergence rate of gradient norm for non-convex optimization.
Gaussian DP improves reporting of ML algorithms' differential privacy guarantees.
problem Incomplete and misleading DP guarantees for ML algorithms.
method Using non-asymptotic Gaussian Differential Privacy (GDP) to provide accurate bounds on privacy profiles of ML algorithms.
result GDP captures the entire privacy profile of DP-SGD and related algorithms with virtually no error.
New bounds for KANs trained with DP-SGD, addressing correlated noise.
problem Risk bounds for Kolmogorov-Arnold Networks trained by DP-SGD with correlated noise.
method Established new optimization and population risk analysis for KANs trained with DP-SGD, addressing correlated noise.
result First optimization and population risk analysis of correlated-noise mechanisms for DP training in non-convex settings, including neural networks.
Machine learning (ML) models trained by differentially private stochastic gradient descent (DP-SGD) have much lower utility than the non-private ones. To mitigate this degradation, we propose a DP Laplacian smoothing SGD (DP-LSSGD) to train ML models with differential privacy (DP) guarantees. At the core of DP-LSSGD is…
Optimizes sparse fine-tuning for privacy in neural networks.
problem Performance gap between DP-SGD and non-private fine-tuning.
method Optimization-based approach using private gradient information for selecting trainable weights.
result Our selection method leads to better prediction accuracy compared to existing approaches.
Improved DP-SGD for variational inference reduces noise and variance.
problem Poor convergence and high variance in variational parameter outputs due to gradient noise in DP-SGD.
method Introduced aligned gradients and iterate averaging to reduce DP-induced noise, and noise-aware posteriors.
result Less noisy gradient estimator and improved parameter estimates for variational inference.
Traditionally, the random noise is equally injected when training with different data instances in the field of differential privacy (DP). In this paper, we first give sharper excess risk bounds of DP stochastic gradient descent (SGD) method. Considering most of the previous methods are under convex conditions, we use …
Differential privacy (DP) is a popular mechanism for training machine learning models with bounded leakage about the presence of specific points in the training data. The cost of differential privacy is a reduction in the model's accuracy. We demonstrate that in the neural networks trained using differentially private …
Large-batch stochastic gradient descent (SGD) is widely used for training in distributed deep learning because of its training-time efficiency, however, extremely large-batch SGD leads to poor generalization and easily converges to sharp minima, which prevents naive large-scale data-parallel SGD (DP-SGD) from convergin…
This paper analyzes convergence of DP-SGD with adaptive quantile clipping.
problem Empirical success of adaptive clipping methods lacks theoretical understanding.
method Comprehensive convergence analysis of SGD with quantile clipping (QC-SGD).
result Establishes theoretical guarantees for DP-QC-SGD, revealing relationships between quantile selection, step size, and convergence.
New attacks improve privacy audits by analyzing model updates.
problem Improving privacy audits of AI models through sequence analysis.
method Developed SeMI attacks to identify target insertions in model sequences.
result SeMI attacks achieve higher power and tighter privacy audits.
Improved image generation with private data using perceptual features.
problem Difficulty in training generative models with differential privacy.
method Use pre-trained perceptual features to learn private data distribution.
result Generative models can generate high-quality images with low privacy budget ( ϵ ≈ 2 \epsilon \approx 2 ϵ ≈ 2 ). Structured subsampling improves privacy in deep time series forecasting.
problem Incompatible privacy guarantees with time series forecasting.
method Structured subsampling of sequential data for privacy amplification.
result Structured subsampling enables training with strong privacy guarantees.
Improves zeroth-order optimization for private machine learning with public data.
problem High computation and memory cost of first-order DP methods.
method PAZO (Public Data Assisted Zeroth-order Optimization) framework.
result Achieves superior privacy/utility tradeoffs across tasks.
Improved private geometric median estimation with nearly-linear time complexity.
problem Estimating the geometric median of a dataset while maintaining privacy.
method Improved algorithm using subsampling and geometric aggregation, achieving nearly-linear runtime.
result Achieves the same approximation quality as previous methods but with nearly-linear runtime.
DP-BNNs improve accuracy, privacy, and reliability in neural networks.
problem Balancing privacy and accuracy in neural networks.
method Proposed three DP-BNNs: DP-SGLD, DP-BBP, and DP-MC Dropout.
result DP-SGLD achieves high accuracy under strong privacy guarantees.
Improved DMs with DP-SGD for generating private images.
problem Low privacy of DMs and lack of good privacy-utility tradeoff.
method Adopt LDMs with DP-SGD on attention modules of LDMs.
result Generates high-quality DP images with reduced parameters.
The paper addresses differentially private learning for neural networks, focusing on risk bounds and algorithm feasibility.
problem Achieving differentially private learning for neural networks with theoretical guarantees.
method Developed algorithms and theoretical analysis for differentially private stochastic optimization of neural networks.
result Established theoretical bounds for excess population risk in differentially private learning of neural networks.
The paper analyzes generalization of noisy iterative algorithms using communication theory.
problem Generalization of models trained by noisy iterative algorithms under different distributions.
method Connecting noisy iterative algorithms to additive noise channels in communication theory.
result Distribution-dependent generalization bounds for noisy iterative algorithms.
Improved linear regression with privacy and robustness guarantees.
problem Private and robust linear regression with adversarial corruption.
method Differentially private stochastic gradient descent with full-batch gradient descent and adaptive clipping.
result Near optimal sample complexity for both private and robust linear regression.
Develops DP-SCD for stochastic coordinate descent, making it differentially private.
problem Privacy leak in auxiliary information during stochastic coordinate descent training.
method Develops DP-SCD, leveraging independent noise addition and decoupling/parallelizing coordinate updates.
result Demonstrates competitive performance against DP-SGD with less tuning.
New insights into privacy guarantees for subsampled mechanisms under composition.
problem Tight privacy guarantees for the composition of subsampled differentially private mechanisms.
method Addressed confusion points in privacy accounting for subsampled mechanisms, providing examples and counterexamples.
result Privacy guarantees for subsampled mechanisms differ significantly between Poisson subsampling and sampling without replacement.
Improved DP algorithms for non-convex optimization with tighter generalization bounds.
problem Private stochastic non-convex optimization in high-dimensional spaces.
method Differential privacy techniques, including adaptive algorithms like DP RMSProp and DP Adam, combined with adaptive data analysis.
result Achieved a sharper rate of p 4 / n \sqrt[4]{p}/\sqrt{n} 4 p / n for population loss, improving upon previous bounds.