Abstract:Differential Privacy (DP) is a key property to protect data and models from integrity attacks. In the Deep Learning (DL) field, it is commonly implemented through the Differentially Private Stochastic Gradient Descent (DP-SGD). However, when a model is shared or released, there is no way to check whether it is differentially private, that is, it required to trust the model provider. This situation poses a problem when data privacy is mandatory, specially with current data regulations, as the presence of DP can not be certificated consistently by any third party. Thus, we face the challenge of determining whether a DL model has been trained with DP, according to the title question: Can we infer the presence of Differential Privacy in Deep Learning models' weights? Since the DP-SGD significantly changes the training process of a DL model, we hypothesize that DP leaves an imprint in the weights of a DL model, which can be used to predict whether a model has been trained with DP regardless of its architecture and the training dataset. In this paper, we propose to employ the imprint in model weights of using DP to infer the presence of DP training in a DL model. To substantiate our hypothesis, we developed an experimental methodology based on two datasets of weights of DL models, each with models with and without DP training and a meta-classifier to infer whether DP was used in the training process of a DL model, by accessing its weights. We accomplish both, the removal of the requirement of a trusted model provider and a strong foundation for this interesting line of research. Thus, our contribution is an additional layer of security on top of the strict private requirements of DP training in DL models, towards to DL models.

Differential Privacy Regularization: Protecting Training Data Through Loss Function Regularization

Differential Privacy Meets Neural Network Pruning

A(DP)$^2$SGD: Asynchronous Decentralized Parallel Stochastic Gradient Descent with Differential Privacy

Individual Privacy Accounting for Differentially Private Stochastic Gradient Descent

Normalized/Clipped SGD with Perturbation for Differentially Private Non-Convex Optimization

Can we infer the presence of Differential Privacy in Deep Learning models' weights? Towards more secure Deep Learning

DPDR: Gradient Decomposition and Reconstruction for Differentially Private Deep Learning

A(DP)$^2$2SGD: Asynchronous Decentralized Parallel Stochastic Gradient Descent with Differential Privacy

DP-SGD with weight clipping

Training Private Models That Know What They Don't Know

DP-LSSGD: A Stochastic Optimization Method to Lift the Utility in Privacy-Preserving ERM

Improving Differentially Private Models with Active Learning

Equivariant Differentially Private Deep Learning: Why DP-SGD Needs Sparser Models

DP-SGD for non-decomposable objective functions

Too Good to be True? Turn Any Model Differentially Private With DP-Weights

Deep Learning with Differential Privacy

Towards Efficient and Scalable Training of Differentially Private Deep Learning

Differentially private stochastic gradient descent with low-noise

Differentially Private SGD with Random Features

GReDP: A More Robust Approach for Differential Private Training with Gradient-Preserving Noise Reduction

Differentially Private Learning with Small Public Data.