Scalable Private Learning with PATE

Abstract

The rapid adoption of machine learning has increased concerns about the privacy implications of machine learning models trained on sensitive data, such as medical records or other personal information. To address those concerns, one promising approach is Private Aggregation of Teacher Ensembles, or PATE, which transfers to a "student" model the knowledge of an ensemble of "teacher" models, with intuitive privacy provided by training teachers on disjoint data and strong privacy guaranteed by noisy aggregation of teachers' answers. However, PATE has so far been evaluated only on simple classification tasks like MNIST, leaving unclear its utility when applied to larger-scale learning tasks and real-world datasets. In this work, we show how PATE can scale to learning tasks with large numbers of output classes and uncurated, imbalanced training data with errors. For this, we introduce new noisy aggregation mechanisms for teacher ensembles that are more selective and add less noise, and prove their tighter differential-privacy guarantees. Our new mechanisms build on two insights: the chance of teacher consensus is increased by using more concentrated noise and, lacking consensus, no answer need be given to a student. The consensus answers used are more likely to be correct, offer better intuitive privacy, and incur lower-differential privacy cost. Our evaluation shows our mechanisms improve on the original PATE on all measures, and scale to larger tasks with both high utility and very strong privacy ($\epsilon$ < 1.0).

arXiv commentPublished as a conference paper at ICLR 2018

References in corpus (9)

• Rényi Divergence and Kullback-Leibler Divergence
• Improved Techniques for Training GANs
• Renyi Differential Privacy
• Learning Differentially Private Recurrent Language Models
• Stealing Machine Learning Models via Prediction APIs
• Detecting Cancer Metastases on Gigapixel Pathology Images
• Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learning
• Learning Privately from Multiparty Data
• Plausible Deniability for Privacy-Preserving Data Synthesis

Cited by in corpus (95)

• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• How To Backdoor Federated Learning
• MixMatch: A Holistic Approach to Semi-Supervised Learning
• Distillation-Based Semi-Supervised Federated Learning for Communication-Efficient Collaborative Training with Non-IID Private Data
• HybridAlpha: An Efficient Approach for Privacy-Preserving Federated Learning
• Federated Learning with Bayesian Differential Privacy
• Differentially Private Synthetic Medical Data Generation using Convolutional GANs
• Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference
• Privacy Amplification by Iteration
• Privacy in Deep Learning: A Survey
• Understanding and Improving Knowledge Distillation
• Differentially Private Learning with Adaptive Clipping
• Data synthesis and adversarial networks: A review and meta-analysis in cancer imaging
• Data Minimization for GDPR Compliance in Machine Learning Models
• Large Language Models Can Be Strong Differentially Private Learners
• A Hybrid Approach to Privacy-Preserving Federated Learning
• Security and Privacy Issues in Deep Learning
• TIPRDC: Task-Independent Privacy-Respecting Data Crowdsourcing Framework for Deep Learning with Anonymized Intermediate Representations
• Differentially Private Fine-tuning of Language Models
• DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation
• Private Machine Learning in TensorFlow using Secure Computation
• Differential Privacy and Fairness in Decisions and Learning Tasks: A Survey
• Privacy Adversarial Network: Representation Learning for Mobile Data Privacy
• Generating Artificial Data for Private Deep Learning
• A Federated Deep Learning Framework for Privacy Preservation and Communication Efficiency
• Differentially Private Data Generative Models
• Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective
• Differentially-Private "Draw and Discard" Machine Learning
• Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning
• Learning Privacy-Preserving Student Networks via Discriminative-Generative Distillation
• Practical Defences Against Model Inversion Attacks for Split Neural Networks
• Hypothesis Testing Interpretations and Renyi Differential Privacy
• LDP-Fed: Federated Learning with Local Differential Privacy
• Machine Learning with Membership Privacy using Adversarial Regularization
• Privacy-Preserving Ensemble Infused Enhanced Deep Neural Network Framework for Edge Cloud Convergence
• Deep Learning with Gaussian Differential Privacy
• Membership Inference Attack Susceptibility of Clinical Language Models
• Private Model Compression via Knowledge Distillation
• Cross-Institutional Transfer Learning for Educational Models: Implications for Model Performance, Fairness, and Equity
• DP-LSSGD: A Stochastic Optimization Method to Lift the Utility in Privacy-Preserving ERM
• A Differentially Private Framework for Deep Learning with Convexified Loss Functions
• DPIS: An Enhanced Mechanism for Differentially Private SGD with Importance Sampling
• Leveraging Public Data for Practical Private Query Release
• SPEED: Secure, PrivatE, and Efficient Deep learning
• Knowledge Cross-Distillation for Membership Privacy
• Training Production Language Models without Memorizing User Data
• Synthetic Observational Health Data with GANs: from slow adoption to a boom in medical research and ultimately digital twins?
• Large Scale Private Learning via Low-rank Reparametrization
• Estimating Smooth GLM in Non-interactive Local Differential Privacy Model with Public Unlabeled Data
• SoK: Machine Learning Governance
• Private Query Release Assisted by Public Data
• Private Post-GAN Boosting
• A Marauder's Map of Security and Privacy in Machine Learning
• Privacy-Preserving Blockchain Based Federated Learning with Differential Data Sharing
• Wide Network Learning with Differential Privacy
• Robin Hood and Matthew Effects: Differential Privacy Has Disparate Impact on Synthetic Data
• Differentially Private Federated Learning with Laplacian Smoothing
• Bayesian Differential Privacy for Machine Learning
• Secure Deep Graph Generation with Link Differential Privacy
• Advances in Differential Privacy and Differentially Private Machine Learning
• Practical One-Shot Federated Learning for Cross-Silo Setting
• On the Privacy Risks of Algorithmic Fairness
• PAC learning with stable and private predictions
• A Fairness Analysis on Private Aggregation of Teacher Ensembles
• Quantifying and Mitigating Privacy Risks of Contrastive Learning
• Deep Learning with Label Differential Privacy
• Voting-based Approaches For Differentially Private Federated Learning
• Understanding the Tradeoffs in Client-side Privacy for Downstream Speech Tasks
• PATE-AAE: Incorporating Adversarial Autoencoder into Private Aggregation of Teacher Ensembles for Spoken Command Classification
• PrivColl: Practical Privacy-Preserving Collaborative Machine Learning
• A Fully Private Pipeline for Deep Learning on Electronic Health Records
• The Trade-Offs of Private Prediction
• Situated Case Studies for a Human-Centered Design of Explanation User Interfaces
• Public Data-Assisted Mirror Descent for Private Model Training
• DPlis: Boosting Utility of Differentially Private Deep Learning via Randomized Smoothing
• Revisiting Model-Agnostic Private Learning: Faster Rates and Active Learning
• Adaptive Distillation for Decentralized Learning from Heterogeneous Clients
• Towards Distributed Privacy-Preserving Prediction
• ArchNet: Data Hiding Model in Distributed Machine Learning System
• Boosting Model Performance through Differentially Private Model Aggregation
• Decentralized Differentially Private Without-Replacement Stochastic Gradient Descent
• Selective Ensembles for Consistent Predictions
• An Empirical Study on the Intrinsic Privacy of SGD
• An Extension of Fano's Inequality for Characterizing Model Susceptibility to Membership Inference Attacks
• Private Dataset Generation Using Privacy Preserving Collaborative Learning
• Private Deep Learning with Teacher Ensembles
• Generative Models for Security: Attacks, Defenses, and Opportunities
• Free Gap Information from the Differentially Private Sparse Vector and Noisy Max Mechanisms
• Photonic Differential Privacy with Direct Feedback Alignment
• Quantifying Membership Privacy via Information Leakage
• On the Intrinsic Differential Privacy of Bagging
• Reducing Risk of Model Inversion Using Privacy-Guided Training
• Private Knowledge Transfer via Model Distillation with Generative Adversarial Networks
• Selective Differential Privacy for Language Modeling
• DP-SGD vs PATE: Which Has Less Disparate Impact on GANs?