DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation

Abstract

Recent success of deep neural networks (DNNs) hinges on the availability of large-scale dataset; however, training on such dataset often poses privacy risks for sensitive training information. In this paper, we aim to explore the power of generative models and gradient sparsity, and propose a scalable privacy-preserving generative model DATALENS. Comparing with the standard PATE privacy-preserving framework which allows teachers to vote on one-dimensional predictions, voting on the high dimensional gradient vectors is challenging in terms of privacy preservation. As dimension reduction techniques are required, we need to navigate a delicate tradeoff space between (1) the improvement of privacy preservation and (2) the slowdown of SGD convergence. To tackle this, we take advantage of communication efficient learning and propose a novel noise compression and aggregation approach TOPAGG by combining top-k compression for dimension reduction with a corresponding noise injection mechanism. We theoretically prove that the DATALENS framework guarantees differential privacy for its generated data, and provide analysis on its convergence. To demonstrate the practical usage of DATALENS, we conduct extensive experiments on diverse datasets including MNIST, Fashion-MNIST, and high dimensional CelebA, and we show that, DATALENS significantly outperforms other baseline DP generative models. In addition, we adapt the proposed TOPAGG approach, which is one of the key building blocks in DATALENS, to DP SGD training, and show that it is able to achieve higher utility than the state-of-the-art DP SGD approach in most cases. Our code is publicly available at https://github.com/AI-secure/DataLens.

arXiv commentAccepted to ACM CCS 2021. 23 pages, 4 figures, 12 tables

References in corpus (31)

• Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks
• Deep Learning with Differential Privacy
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Renyi Differential Privacy
• QSGD: Communication-Efficient SGD via Gradient Quantization and Encoding
• Which Training Methods for GANs do actually Converge?
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Can Decentralized Algorithms Outperform Centralized Algorithms? A Case Study for Decentralized Parallel Stochastic Gradient Descent
• Asynchronous Parallel Stochastic Gradient for Nonconvex Optimization
• Scalable Private Learning with PATE
• Differentially Private Generative Adversarial Network
• GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
• A simple and practical algorithm for differentially private data release
• Demystifying Parallel and Distributed Deep Learning: An In-Depth Concurrency Analysis
• Gradient Sparsification for Communication-Efficient Distributed Optimization
• Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data
• Decentralized Stochastic Optimization and Gossip Algorithms with Compressed Communication
• cpSGD: Communication-efficient and differentially-private distributed SGD
• Towards Efficient Data Valuation Based on the Shapley Value
• Communication Compression for Decentralized Training
• A General Approach to Adding Differential Privacy to Iterative Training Procedures
• Rényi Differential Privacy of the Sampled Gaussian Mechanism
• signSGD: Compressed Optimisation for Non-Convex Problems
• Differentially Private Learning with Adaptive Clipping
• ALICE: Towards Understanding Adversarial Learning for Joint Distribution Matching
• AdaCliP: Adaptive Clipping for Private SGD
• Understanding Gradient Clipping in Private SGD: A Geometric Perspective
• The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation
• D2P-Fed: Differentially Private Federated Learning With Efficient Communication
• ScaleCom: Scalable Sparsified Gradient Compression for Communication-Efficient Distributed Training

Cited by in corpus (3)

• Privacy-Preserving Machine Learning: Methods, Challenges and Directions
• Learning Privacy-Preserving Student Networks via Discriminative-Generative Distillation
• Don't Generate Me: Training Differentially Private Generative Models with Sinkhorn Divergence