From Privacy to Generalization: Linear Max-Information Bounds for Differentially Private Learning Algorithms

Abstract

Understanding the relationship between generalization and privacy remains a challenge in modern machine learning theory, particularly for deep networks that are trained by variants of differentially private stochastic gradient descent (DP- SGD). In this work we make progress on this persistent open problem. First, we derive explicit upper bounds on the approximate max-information of any algorithm that fulfills $(\epsilon ,\delta )$-differential privacy or Rényi differential privacy, thereby going beyond the classical results for pure $\epsilon$-differential privacy. Subsequently, we show even stronger guarantees for two common private learning algorithms, output perturbation with the Gaussian mechanism, and streaming DP-SGD, by exploiting the structure of their internal randomization. As an application of our results, we demonstrate how to obtain non-vacuous PAC-Bayes generalization bounds for deep networks, in which the prior distribution is learned by DP-SGD instead of the classical way of choosing it in a data-independent way.

arXiv comment41 pages, replacement of v1 which had a mistake in Theorem 1 (multi-epoch training should not have been included)