Robust and Private Learning of Halfspaces

Abstract

In this work, we study the trade-off between differential privacy and adversarial robustness under L2-perturbations in the context of learning halfspaces. We prove nearly tight bounds on the sample complexity of robust private learning of halfspaces for a large regime of parameters. A highlight of our results is that robust and private learning is harder than robust or private learning alone. We complement our theoretical analysis with experimental results on the MNIST and USPS datasets, for a learning algorithm that is both differentially private and adversarially robust.

arXiv commentAISTATS 2021

References in corpus (11)

• Deep Learning with Differential Privacy
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Renyi Differential Privacy
• Towards the first adversarially robust neural network model on MNIST
• Adversarial Training Can Hurt Generalization
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Scalable Differential Privacy with Certified Robustness in Adversarial Learning
• Adversarial Risk Bounds via Function Transformation
• On Robustness to Adversarial Examples and Polynomial Optimization
• Efficient Private Algorithms for Learning Large-Margin Halfspaces

Cited by in corpus (1)

• Normal approximations for the multivariate inverse Gaussian distribution and asymmetric kernel smoothing on $d$-dimensional half-spaces