Differentially Private Learning Needs Better Features (or Much More Data)

Abstract

We demonstrate that differentially private machine learning has not yet reached its "AlexNet moment" on many canonical vision tasks: linear models trained on handcrafted features significantly outperform end-to-end deep neural networks for moderate privacy budgets. To exceed the performance of handcrafted features, we show that private learning requires either much more private data, or access to features learned on public data from a similar domain. Our work introduces simple yet strong baselines for differentially private learning that can inform the evaluation of future progress in this area.

ICLR 2021. Code available at https://github.com/ftramer/Handcrafted-DP

References in corpus (32)

• A Simple Framework for Contrastive Learning of Visual Representations
• Deep Learning with Differential Privacy
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Accurate, Large Minibatch SGD: Training ImageNet in 1 Hour
• Neural Tangent Kernel: Convergence and Generalization in Neural Networks
• Renyi Differential Privacy
• Learning Differentially Private Recurrent Language Models
• Deep Scattering Spectrum
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Differentially Private Federated Learning: A Client Level Perspective
• Big Self-Supervised Models are Strong Semi-Supervised Learners
• Extracting Training Data from Large Language Models
• Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data
• Do CIFAR-10 Classifiers Generalize to CIFAR-10?
• Privacy Amplification by Iteration
• Subsampled Rényi Differential Privacy and Analytical Moments Accountant
• Rényi Differential Privacy of the Sampled Gaussian Mechanism
• Differentially Private Learning with Adaptive Clipping
• Scattering Networks for Hybrid Representation Learning
• Enhanced Convolutional Neural Tangent Kernels
• Auditing Differentially Private Machine Learning: How Private is Private SGD?
• Salvaging Federated Learning by Local Adaptation
• Large image datasets: A pyrrhic win for computer vision?
• Neural Kernels Without Tangents
• Tempered Sigmoid Activations for Deep Learning with Differential Privacy
• Deep Learning with Gaussian Differential Privacy
• Improving Deep Learning with Differential Privacy using Gradient Encoding and Denoising
• Individual Privacy Accounting via a Renyi Filter
• Private Stochastic Non-Convex Optimization: Adaptive Algorithms and Tighter Generalization Bounds
• Fast Dimension Independent Private AdaGrad on Publicly Estimated Subspaces
• Gradient Perturbation is Underrated for Differentially Private Convex Optimization
• Stochastic Adaptive Line Search for Differentially Private Optimization

Cited by in corpus (13)

• How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy
• A Survey of Privacy Vulnerabilities of Mobile Device Sensors
• Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Survey
• The Skellam Mechanism for Differentially Private Federated Learning
• The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation
• Training Data Leakage Analysis in Language Models
• DPIS: An Enhanced Mechanism for Differentially Private SGD with Importance Sampling
• SoK: Machine Learning Governance
• Benchmarking Differential Privacy and Federated Learning for BERT Models
• Privacy Regularization: Joint Privacy-Utility Optimization in Language Models
• Generalization Techniques Empirically Outperform Differential Privacy against Membership Inference
• Differentially Private Adapters for Parameter Efficient Acoustic Modeling
• Differential Privacy, Linguistic Fairness, and Training Data Influence: Impossibility and Possibility Theorems for Multilingual Language Models