DPIS: An Enhanced Mechanism for Differentially Private SGD with Importance Sampling

Abstract

Nowadays, differential privacy (DP) has become a well-accepted standard for privacy protection, and deep neural networks (DNN) have been immensely successful in machine learning. The combination of these two techniques, i.e., deep learning with differential privacy, promises the privacy-preserving release of high-utility models trained with sensitive data such as medical records. A classic mechanism for this purpose is DP-SGD, which is a differentially private version of the stochastic gradient descent (SGD) optimizer commonly used for DNN training. Subsequent approaches have improved various aspects of the model training process, including noise decay schedule, model architecture, feature engineering, and hyperparameter tuning. However, the core mechanism for enforcing DP in the SGD optimizer remains unchanged ever since the original DP-SGD algorithm, which has increasingly become a fundamental barrier limiting the performance of DP-compliant machine learning solutions. Motivated by this, we propose DPIS, a novel mechanism for differentially private SGD training that can be used as a drop-in replacement of the core optimizer of DP-SGD, with consistent and significant accuracy gains over the latter. The main idea is to employ importance sampling (IS) in each SGD iteration for mini-batch selection, which reduces both sampling variance and the amount of random noise injected to the gradients that is required to satisfy DP. Integrating IS into the complex mathematical machinery of DP-SGD is highly non-trivial. DPIS addresses the challenge through novel mechanism designs, fine-grained privacy analysis, efficiency enhancements, and an adaptive gradient clipping optimization. Extensive experiments on four benchmark datasets, namely MNIST, FMNIST, CIFAR-10 and IMDb, demonstrate the superior effectiveness of DPIS over existing solutions for deep learning with differential privacy.

References in corpus (18)

• Deep Learning with Differential Privacy
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• An overview of gradient descent optimization algorithms
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Rényi Divergence and Kullback-Leibler Divergence
• Renyi Differential Privacy
• Learning Differentially Private Recurrent Language Models
• Stochastic Gradient Descent for Non-smooth Optimization: Convergence Results and Optimal Averaging Schemes
• Scalable Private Learning with PATE
• Extracting Training Data from Large Language Models
• Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences
• Subsampled Rényi Differential Privacy and Analytical Moments Accountant
• Differentially Private Learning Needs Better Features (or Much More Data)
• AdaCliP: Adaptive Clipping for Private SGD
• Privacy Accounting and Quality Control in the Sage Differentially Private ML Platform
• Unlocking High-Accuracy Differentially Private Image Classification through Scale
• Improving Deep Learning with Differential Privacy using Gradient Encoding and Denoising
• DPIS: An Enhanced Mechanism for Differentially Private SGD with Importance Sampling

Cited by in corpus (1)

• DPIS: An Enhanced Mechanism for Differentially Private SGD with Importance Sampling