Abstract:Differential privacy (DP), as a rigorous mathematical definition quantifying privacy leakage, has become a well-accepted standard for privacy protection. Combined with powerful machine learning (ML) techniques, differentially private machine learning (DPML) is increasingly important. As the most classic DPML algorithm, DP-SGD incurs a significant loss of utility, which hinders DPML's deployment in practice. Many studies have recently proposed improved algorithms based on DP-SGD to mitigate utility loss. However, these studies are isolated and cannot comprehensively measure the performance of improvements proposed in algorithms. More importantly, there is a lack of comprehensive research to compare improvements in these DPML algorithms across utility, defensive capabilities, and generalizability. We fill this gap by performing a holistic measurement of improved DPML algorithms on utility and defense capability against membership inference attacks (MIAs) on image classification tasks. We first present a taxonomy of where improvements are located in the ML life cycle. Based on our taxonomy, we jointly perform an extensive measurement study of the improved DPML algorithms, over twelve algorithms, four model architectures, four datasets, two attacks, and various privacy budget configurations. We also cover state-of-the-art label differential privacy (Label DP) algorithms in the evaluation. According to our empirical results, DP can effectively defend against MIAs, and sensitivity-bounding techniques such as per-sample gradient clipping play an important role in defense. We also explore some improvements that can maintain model utility and defend against MIAs more effectively. Experiments show that Label DP algorithms achieve less utility loss but are fragile to MIAs. ML practitioners may benefit from these evaluations to select appropriate algorithms. To support our evaluation, we implement a modular re-usable software, DPMLBench,(1) which enables sensitive data owners to deploy DPML algorithms and serves as a benchmark tool for researchers and practitioners.

Private, Yet Practical, Multiparty Deep Learning.

Privacy-Preserving Collaborative Deep Learning with Unreliable Participants.

GELU-Net: A Globally Encrypted, Locally Unencrypted Deep Neural Network for Privacy-Preserved Learning.

Privacy-preserving Decentralized Deep Learning with Multiparty Homomorphic Encryption

Multiparty Dual Learning

Efficient Deep Learning on Multi-Source Private Data

DPMLBench: Holistic Evaluation of Differentially Private Machine Learning

pMPL: A Robust Multi-Party Learning Framework with a Privileged Party

PDLM: Privacy-Preserving Deep Learning Model on Cloud with Multiple Keys

SHAPER: A General Architecture for Privacy-Preserving Primitives in Secure Machine Learning.

Privacy-Preserving Hierarchical Model-Distributed Inference

Learning from Multi-Dimensional Partial Labels.

How to Democratise and Protect AI: Fair and Differentially Private Decentralised Deep Learning

Multiparty Secure Broad Learning System for Privacy Preserving

Adaptively Private Next-Token Prediction of Large Language Models

Private, Efficient, and Accurate: Protecting Models Trained by Multi-party Learning with Differential Privacy

Locally Differentially Private Distributed Deep Learning via Knowledge Distillation

Generalizing Differentially Private Decentralized Deep Learning with Multi-Agent Consensus

Private Multi-Task Learning: Formulation and Applications to Federated Learning

EPDL: an Efficient and Privacy-Preserving Deep Learning for Crowdsensing

Multi-Epoch Matrix Factorization Mechanisms for Private Machine Learning