Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning

Abstract

The privacy leakage of the model about the training data can be bounded in the differential privacy mechanism. However, for meaningful privacy parameters, a differentially private model degrades the utility drastically when the model comprises a large number of trainable parameters. In this paper, we propose an algorithm \emph{Gradient Embedding Perturbation (GEP)} towards training differentially private deep models with decent accuracy. Specifically, in each gradient descent step, GEP first projects individual private gradient into a non-sensitive anchor subspace, producing a low-dimensional gradient embedding and a small-norm residual gradient. Then, GEP perturbs the low-dimensional embedding and the residual gradient separately according to the privacy budget. Such a decomposition permits a small perturbation variance, which greatly helps to break the dimensional barrier of private learning. With GEP, we achieve decent accuracy with reasonable computational cost and modest privacy guarantee for deep models. Especially, with privacy bound $\epsilon =8$, we achieve $74.9\%$ test accuracy on CIFAR10 and $95.1\%$ test accuracy on SVHN, significantly improving over existing results.

arXiv commentPublished as a conference paper at ICLR 2021. Source code available at https://github.com/dayu11/Gradient-Embedding-Perturbation

References in corpus (18)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Deep Learning with Differential Privacy
• Renyi Differential Privacy
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Big Self-Supervised Models are Strong Semi-Supervised Learners
• Scalable Private Learning with PATE
• Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences
• PowerSGD: Practical Low-Rank Gradient Compression for Distributed Optimization
• Gradient Descent Happens in a Tiny Subspace
• Gaussian Differential Privacy
• Subsampled Rényi Differential Privacy and Analytical Moments Accountant
• Rényi Differential Privacy of the Sampled Gaussian Mechanism
• Differentially Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Bounds
• Iterative Methods for Computing Eigenvalues and Eigenvectors
• Scalable Differential Privacy with Certified Robustness in Adversarial Learning
• Assessing differentially private deep learning with Membership Inference
• Limits of Private Learning with Access to Public Data
• How Does Data Augmentation Affect Privacy in Machine Learning?

Cited by in corpus (8)

• Large Language Models Can Be Strong Differentially Private Learners
• Differentially Private Fine-tuning of Language Models
• Learning Privacy-Preserving Student Networks via Discriminative-Generative Distillation
• Differential Privacy in Natural Language Processing: The Story So Far
• Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective
• Bypassing the Ambient Dimension: Private SGD with Gradient Subspace Identification
• Large Scale Private Learning via Low-rank Reparametrization
• Improving Differentially Private SGD via Randomly Sparsified Gradients