Abstract:Differential privacy (DP), as a rigorous mathematical definition quantifying privacy leakage, has become a well-accepted standard for privacy protection. Combined with powerful machine learning (ML) techniques, differentially private machine learning (DPML) is increasingly important. As the most classic DPML algorithm, DP-SGD incurs a significant loss of utility, which hinders DPML's deployment in practice. Many studies have recently proposed improved algorithms based on DP-SGD to mitigate utility loss. However, these studies are isolated and cannot comprehensively measure the performance of improvements proposed in algorithms. More importantly, there is a lack of comprehensive research to compare improvements in these DPML algorithms across utility, defensive capabilities, and generalizability. We fill this gap by performing a holistic measurement of improved DPML algorithms on utility and defense capability against membership inference attacks (MIAs) on image classification tasks. We first present a taxonomy of where improvements are located in the ML life cycle. Based on our taxonomy, we jointly perform an extensive measurement study of the improved DPML algorithms, over twelve algorithms, four model architectures, four datasets, two attacks, and various privacy budget configurations. We also cover state-of-the-art label differential privacy (Label DP) algorithms in the evaluation. According to our empirical results, DP can effectively defend against MIAs, and sensitivity-bounding techniques such as per-sample gradient clipping play an important role in defense. We also explore some improvements that can maintain model utility and defend against MIAs more effectively. Experiments show that Label DP algorithms achieve less utility loss but are fragile to MIAs. ML practitioners may benefit from these evaluations to select appropriate algorithms. To support our evaluation, we implement a modular re-usable software, DPMLBench,(1) which enables sensitive data owners to deploy DPML algorithms and serves as a benchmark tool for researchers and practitioners.

Sub-optimal Learning in Meta-Classifier Attacks: A Study of Membership Inference on Differentially Private Location Aggregates

DPMLBench: Holistic Evaluation of Differentially Private Machine Learning

Privacy for All: Demystify Vulnerability Disparity of Differential Privacy against Membership Inference Attack

Discriminative Adversarial Privacy: Balancing Accuracy and Membership Privacy in Neural Networks

Investigating Membership Inference Attacks under Data Dependencies

Differentially Private and Adversarially Robust Machine Learning: An Empirical Evaluation

A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate Location Data

Measuring Membership Privacy on Aggregate Location Time-Series

Membership Privacy for Machine Learning Models Through Knowledge Transfer

Differential Privacy Protection Against Membership Inference Attack on Machine Learning for Genomic Data

Defending Privacy Against More Knowledgeable Membership Inference Attackers

When Fairness Meets Privacy: Exploring Privacy Threats in Fair Binary Classifiers via Membership Inference Attacks

Machine Learning with Membership Privacy using Adversarial Regularization

Defenses to Membership Inference Attacks: A Survey

Protection Against Reconstruction and Its Applications in Private Federated Learning

A Comprehensive Study of Privacy Risks in Curriculum Learning

Insuring against the perils in distributed learning: privacy-preserving empirical risk minimization

Evaluating Differentially Private Machine Learning in Practice

TMI! Finetuned Models Leak Private Information from their Pretraining Data

How Much Does Each Datapoint Leak Your Privacy? Quantifying the Per-datum Membership Leakage

Order of Magnitude Speedups for LLM Membership Inference