Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data

Abstract

Some machine learning applications involve training data that is sensitive, such as the medical histories of patients in a clinical trial. A model may inadvertently and implicitly store some of its training data; careful analysis of the model may therefore reveal sensitive information. To address this problem, we demonstrate a generally applicable approach to providing strong privacy guarantees for training data: Private Aggregation of Teacher Ensembles (PATE). The approach combines, in a black-box fashion, multiple models trained with disjoint datasets, such as records from different subsets of users. Because they rely directly on sensitive data, these models are not published, but instead used as "teachers" for a "student" model. The student learns to predict an output chosen by noisy voting among all of the teachers, and cannot directly access an individual teacher or the underlying data or parameters. The student's privacy properties can be understood both intuitively (since no single teacher and thus no single dataset dictates the student's training) and formally, in terms of differential privacy. These properties hold even if an adversary can not only query the student but also inspect its internal workings. Compared with previous work, the approach imposes only weak assumptions on how teachers are trained: it applies to any model, including non-convex models like DNNs. We achieve state-of-the-art privacy/utility trade-offs on MNIST and SVHN thanks to an improved privacy analysis and semi-supervised learning.

Accepted to ICLR 17 as an oral

Cited by in corpus (62)

• Knowledge Distillation: A Survey
• Distillation-Based Semi-Supervised Federated Learning for Communication-Efficient Collaborative Training with Non-IID Private Data
• How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy
• Privacy Amplification by Iteration
• TeaNet: universal neural network interatomic potential inspired by iterative electronic relaxations
• When Machine Learning Meets Privacy: A Survey and Outlook
• Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer
• Systematic Evaluation of Privacy Risks of Machine Learning Models
• Evaluating Differentially Private Machine Learning in Practice
• A review of Generative Adversarial Networks for Electronic Health Records: applications, evaluation measures and data sources
• Differentially Private Learning Needs Better Features (or Much More Data)
• Security and Privacy Issues in Deep Learning
• Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Survey
• Differentially Private Fine-tuning of Language Models
• DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation
• ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models
• Generative Models for Effective ML on Private, Decentralized Datasets
• On the Protection of Private Information in Machine Learning Systems: Two Recent Approaches
• Honest-but-Curious Nets: Sensitive Attributes of Private Inputs Can Be Secretly Coded into the Classifiers' Outputs
• Not Just Privacy: Improving Performance of Private Deep Learning in Mobile Cloud
• DP-MERF: Differentially Private Mean Embeddings with Random Features for Practical Privacy-Preserving Data Generation
• Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture
• Model extraction from counterfactual explanations
• SPEED: Secure, PrivatE, and Efficient Deep learning
• Knowledge Cross-Distillation for Membership Privacy
• Bypassing the Ambient Dimension: Private SGD with Gradient Subspace Identification
• A Flexible Selection Scheme for Minimum-Effort Transfer Learning
• An Overview of Privacy in Machine Learning
• That which we call private
• Assessing differentially private deep learning with Membership Inference
• TransMIA: Membership Inference Attacks Using Transfer Shadow Training
• MEAL: Multi-Model Ensemble via Adversarial Learning
• Representation Transfer for Differentially Private Drug Sensitivity Prediction
• Efficient Privacy-Preserving Stochastic Nonconvex Optimization
• Key Protected Classification for Collaborative Learning
• Synthetic Data -- Anonymisation Groundhog Day
• Differentially Private Federated Learning with Laplacian Smoothing
• A novel analysis of utility in privacy pipelines, using Kronecker products and quantitative information flow
• Antipodes of Label Differential Privacy: PATE and ALIBI
• Fairness-aware Agnostic Federated Learning
• Differentially Private Deep Learning with Smooth Sensitivity
• Fidelity-Weighted Learning
• PAC learning with stable and private predictions
• Deep Learning with Label Differential Privacy
• Differentially Private Continual Learning
• Model Compression with Two-stage Multi-teacher Knowledge Distillation for Web Question Answering System
• Towards a General Model of Knowledge for Facial Analysis by Multi-Source Transfer Learning
• PATE-AAE: Incorporating Adversarial Autoencoder into Private Aggregation of Teacher Ensembles for Spoken Command Classification
• Differential Private Stack Generalization with an Application to Diabetes Prediction
• The Connection between Out-of-Distribution Generalization and Privacy of ML Models
• P3SGD: Patient Privacy Preserving SGD for Regularizing Deep CNNs in Pathological Image Classification
• Sharp Composition Bounds for Gaussian Differential Privacy via Edgeworth Expansion
• Towards Distributed Privacy-Preserving Prediction
• Revisiting Model-Agnostic Private Learning: Faster Rates and Active Learning
• Don't Generate Me: Training Differentially Private Generative Models with Sinkhorn Divergence
• DarkGAN: Exploiting Knowledge Distillation for Comprehensible Audio Synthesis with GANs
• Alleviating Privacy Attacks via Causal Learning
• Adversarial-Based Knowledge Distillation for Multi-Model Ensemble and Noisy Data Refinement
• An Adaptive and Fast Convergent Approach to Differentially Private Deep Learning
• Quantifying Membership Privacy via Information Leakage
• Efficient Private Machine Learning by Differentiable Random Transformations
• Corella: A Private Multi Server Learning Approach based on Correlated Queries