This paper studies trade-offs in private prediction methods.
problem Leakage of training data information in machine learning predictions.
method Private training and private prediction methods with trade-offs.
result Private training methods outperform private prediction methods in various settings.
Public pretraining improves private model training even in extreme distribution shift scenarios.
problem Improving private model training accuracy in settings with large distribution shift.
method Empirical evaluation and theoretical explanation of public representations improving private training accuracy.
result Public representations can improve private training accuracy by up to 67% over private training from scratch in settings with large distribution shift.
Private PGB boosts synthetic data quality using GANs and privacy techniques.
problem Differentially private GANs struggle with convergence and poor output quality.
method Combines reweighted samples from GAN training using Private Multiplicative Weights method.
result Improves synthetic data quality across various datasets and tasks.
PriMORL trains private RL policies on offline data.
problem Private reinforcement learning on offline data.
method PriMORL learns DP models of the environment and optimizes a policy on the penalized private model.
result PriMORL enables training of private RL agents on complex tasks.
Algorithm selects public datasets for private machine learning.
problem Choosing the most suitable public dataset for private machine learning.
method Measures gradient subspace distance between public and private datasets.
result Excess risk scales with the subspace distance between gradients.
DPlis improves privacy in deep learning models by smoothing loss functions.
problem Privacy leakage in deep learning models trained on private data and low model performance.
method DPlis constructs a smooth loss function to favor noise-resilient models.
result DPlis effectively boosts model quality and training stability under privacy constraints.
Paper analyzes InstaHide's security, recovering all private images with provable guarantee.
problem Protecting privacy of training data in neural networks.
method Unified framework to understand and analyze attacks on InstaHide, presenting a new algorithm to recover all private images with provable guarantee.
result InstaHide is computationally secure but not information-theoretically secure when mixing two private images.
We improve private training accuracy with learning rate schedules and matrix factorizations.
problem Private training with learning rate schedules and correlated noise.
method General upper and lower bounds for learning rate schedules, memory-efficient constructions, and schedule-aware factorizations.
result Schedule-aware factorizations improve accuracy in private training.
DPDMs use DP-SGD to generate private synthetic data.
problem Generating private synthetic data from sensitive datasets.
method Introduced DP-SGD for DMs, investigated DM parameterization and sampling, proposed noise multiplicity.
result Achieved state-of-the-art performance in image generation benchmarks.
DPZero fine-tunes large models privately without backpropagation.
problem Memory and privacy challenges in fine-tuning large language models.
method DPZero uses zeroth-order methods for private fine-tuning, avoiding backpropagation.
result DPZero achieves private fine-tuning of RoBERTa and OPT on various tasks.
DP-SGD can update fewer coordinates while maintaining privacy.
problem How to update fewer coordinates in DP-SGD without losing optimization signal.
method TP-TopK (Two-Phase TopK DP-SGD), a two-phase method for coordinate-sparse private training.
result Private training can update fewer coordinates without losing optimization signal, scaling noise with active dimension \(k\) instead of full dimension \(d\).
Differentially private algorithms protect model explanations from leaking training data.
problem Model explanations can leak training data, compromising privacy.
method Adaptive differentially private gradient descent algorithm to produce accurate, private explanations.
result Privacy amplification and reduction of overall privacy loss on explanation data.
DiPriMe forests use private medians to create balanced tree splits for privacy-protected data.
problem Privacy concerns in training random forests due to multiple data queries.
method Proposes DiPriMe forests, which use a private median to generate balanced splits, ensuring differential privacy.
result DiPriMe forests achieve high utility while maintaining differential privacy, as shown both theoretically and empirically.
New methods speed up training of differentially private deep learning models.
problem Training differentially private deep learning models is slower than non-private models.
method Derive and implement new per-example gradient clipping methods compatible with auto-differentiation.
result Significant training speed-ups (54x - 94x) for various models and architectures.
Differentially private learning avoids iterative optimization in parameter space.
problem Differentially private training of neural networks
method Hypernetworks trained on public datasets
result Significantly reduces noise in parameter space
Normalization layers improve the accuracy of Differentially Private training of deep neural networks.
problem Reduced accuracy in deep neural networks with Differentially Private training.
method Proposed a novel method for integrating batch normalization with Differentially Private Stochastic Gradient Descent (DPSGD) without additional privacy loss.
result Training deeper networks with better utility-privacy trade-off is possible.
Improved image generation with private data using perceptual features.
problem Difficulty in training generative models with differential privacy.
method Use pre-trained perceptual features to learn private data distribution.
result Generative models can generate high-quality images with low privacy budget (ϵ≈2). Improved differentially private deep learning with group-wise clipping techniques.
problem Efficiency and privacy trade-offs in deep learning models.
method Group-wise clipping techniques (per-layer and per-device) to reduce compute time and memory overhead.
result Private learning with group-wise clipping achieves similar or better performance than non-private learning with less wall time.
Private learning needs more data or better features.
problem Improving differentially private machine learning performance.
method Demonstrates the need for either more private data or better features.
result Private learning requires either more data or better features.
New algorithms improve privacy and utility of large language models.
problem Privacy-preserving fine-tuning of large language models.
method Meta-framework for differentially private fine-tuning, inspired by recent success in fine-tuning.
result Private fine-tuned models achieve utility close to non-private models, with improved privacy and efficiency.
We study the problem of estimating high dimensional models with underlying sparse structures while preserving the privacy of each training example. We develop a differentially private high-dimensional sparse learning framework using the idea of knowledge transfer. More specifically, we propose to distill the knowledge …
Study shows privacy and utility trade-offs in synthetic data models, impacting fairness and real-world performance.
problem Understanding the impact of differential privacy on fairness and model performance in synthetic data.
method Systematic analysis of differentially private synthetic datasets on classification models, measuring utility and bias using fairness metrics.
result More privacy does not necessarily mean more bias, but it can affect model performance when deployed on real data.
PASS protects private attributes by stochastically substituting data.
problem Protecting private attributes in ML services while maintaining data utility.
method PASS uses stochastic data substitution with a novel loss function derived from information theory.
result PASS effectively protects private attributes across various datasets.
Gradient clipping helps private SGD converge despite potential bias.
problem Gradient clipping in private SGD can bias convergence.
method Theoretical analysis and empirical evaluation of gradient clipping effects.
result Gradient clipping can prevent convergence to stationary points and introduces bias.
Optimizes sparse fine-tuning for privacy in neural networks.
problem Performance gap between DP-SGD and non-private fine-tuning.
method Optimization-based approach using private gradient information for selecting trainable weights.
result Our selection method leads to better prediction accuracy compared to existing approaches.
This paper presents a method to train a public model with private data using GANs and differential privacy.
problem Privacy concerns in training deep learning models on sensitive data.
method A three-player learning framework with differential privacy protection.
result The proposed method achieves a balance between privacy and model accuracy.
A key factor in developing high performing machine learning models is the availability of sufficiently large datasets. This work is motivated by applications arising in Software as a Service (SaaS) companies where there exist numerous similar yet disjoint datasets from multiple client companies. To overcome the challen…
Differentially private learning on real-world data poses challenges for standard machine learning practice: privacy guarantees are difficult to interpret, hyperparameter tuning on private data reduces the privacy budget, and ad-hoc privacy attacks are often required to test model privacy. We introduce three tools to ma…
AriaNN enables private deep learning with minimal interaction and reduced key sizes.
problem Private deep learning with minimal interaction and reduced key sizes.
method Semi-honest 2-party computation protocol with function secret sharing, optimized primitives for neural network operations.
result Efficient private comparison for ReLU operations with reduced key size and improved performance.
Optimal DP model training with public data improves privacy and accuracy.
problem Ensuring privacy while training models with public data.
method Proves optimal error rates for DP model training with public data, develops novel algorithms.
result Optimal error rates can be achieved by using public data or optimal DP algorithms.
Asynchronous algorithms reduce privacy costs in distributed machine learning.
problem Privacy concerns in training machine learning models on scattered private data.
method Differentially-private asynchronous algorithms for collaborative training.
result Cost of privacy is inversely proportional to dataset size and privacy budgets.
This paper operationalizes the Exponential Mechanism using Normalizing Flows for private optimization.
problem Improving privacy in machine learning while maintaining accuracy and efficiency.
method Using Normalizing Flows to approximate sampling from the Exponential Mechanism for private optimization.
result ExpM+NF provides more privacy than non-private SGD but not as much as DPSGD.
We present a framework to learn privacy-preserving encodings of images that inhibit inference of chosen private attributes, while allowing recovery of other desirable information. Rather than simply inhibiting a given fixed pre-trained estimator, our goal is that an estimator be unable to learn to accurately predict th…
Differentially private GANs improve image privacy without significant quality loss.
problem Anonymizing image data sets while maintaining image quality.
method Training GANs with differential privacy on MNIST, analyzing privacy-utility trade-offs and explaining optimization methods.
result An increasing privacy budget adds little to generated image quality, revealing a saturated training regime.
New method for differentially private optimization with general Lipschitz conditions.
problem Differentially private optimization under general Lipschitz conditions.
method Generalized Lipschitz condition for per-sample gradients, tuning clip norm based on minimum per-sample Lipschitz constant.
result Efficacy of the recommended clip norm tuning method verified on 8 datasets.
We consider learning problems where the training set consists of two types of examples: private and public. The goal is to design a learning algorithm that satisfies differential privacy only with respect to the private examples. This setting interpolates between private learning (where all examples are private) and cl…
Distributed devices such as mobile phones can produce and store large amounts of data that can enhance machine learning models; however, this data may contain private information specific to the data owner that prevents the release of the data. We wish to reduce the correlation between user-specific private information…
A framework for private prediction sets using conformal prediction and differential privacy.
problem Jointly addressing reliability and privacy in machine learning predictions.
method Split conformal prediction with privatized quantile subroutine.
result Private prediction sets can be generated from privately-trained models.
DP-CGAN generates private synthetic data and labels.
problem Preserving privacy in synthetic data generation.
method Differentially private conditional GAN (DP-CGAN) with clipping and perturbation.
result DP-CGAN generates visually and empirically promising results on MNIST with low privacy cost.
FPFL mitigates unfairness in private federated learning.
problem Differential privacy degrades model performance on under-represented groups.
method Extends modified method of differential multipliers to private federated learning.
result FPFL reduces unfairness in trained models on private federated learning.
HDP-VFL hybridizes DP for VFL, reducing privacy costs.
problem Privacy-preserving collaborative learning from vertically partitioned data.
method Hybrid DP framework combining HE and MPC for VFL.
result Achieves DP and JDP with negligible training time and accuracy trade-offs.
Catastrophic forgetting can be a significant problem for institutions that must delete historic data for privacy reasons. For example, hospitals might not be able to retain patient data permanently. But neural networks trained on recent data alone will tend to forget lessons learned on old data. We present a differenti…
DPConvCNP learns to predict private data accurately and privately.
problem Balancing privacy and accuracy in machine learning models.
method Meta-learning combined with improved DP mechanism.
result DPConvCNP outperforms DP GP baseline, especially on non-Gaussian data.
Private training and synthetic data generation using DP clustering.
problem Protecting sensitive data in deep neural networks training.
method Approximate input dataset with privately generated synthetic dataset using DP clustering.
result Simple two-layer neural network achieves SOTA classification accuracy on standard benchmark datasets.
Poisoning datasets can reveal private details of other users' training points.
problem Integrity and privacy of machine learning training data.
method Active inference attacks that poison a small fraction of the training dataset.
result Poisoning as little as 0.1% of the training dataset can significantly boost inference attacks.
Differentially private ensemble classifiers adapt to data streams while protecting privacy.
problem Adapting to evolving data characteristics while protecting private information.
method Unbounded ensemble updates, model agnostic approach.
result Outperforms competitors on various privacy, drift, and distribution settings.
Lower bounds on query complexity for reconstructing private learner's training data.
problem Query complexity of reconstructing private learner's training data.
method Minimax analysis, Rényi DP, Metric DP framework.
result First known lower bounds on adversary's query complexity for various DP learners.
Private cancer prediction model trained on federated genomic data.
problem Train a private cancer prediction model on federated genomic data.
method Differentially private federated learning (FL) for genomic cancer prediction.
result Ranked 3rd in a competition for private cancer prediction.