PaperlayerView exact revision on arXiv

Source-linked AI summary

Adaptive Laplace Mechanism: Differential Privacy Preservation in Deep Learning

NhatHai Phan, Xintao Wu, Han Hu, Dejing Dou

arXiv:1709.05750v2cs.CRcs.LGstat.ML

TL;DR

The paper addresses privacy-preserving deep learning methods whose privacy spending can depend on training steps and whose uniform noise may disregard feature relevance. It proposes AdLM, which perturbs affine transformations and loss functions while adaptively allocating Laplace noise, and reports stronger utility than existing solutions on MNIST and CIFAR-10.

  • Problem

    Privacy-preserving deep learning needs mechanisms that avoid epoch-dependent privacy-budget consumption, adapt noise to feature contribution, and support varied neural networks.

  • Method

    AdLM privately estimates feature relevance with perturbed LRP and adaptively injects Laplace noise into affine transformations and loss-function coefficients.

  • Results

    Experiments on MNIST and CIFAR-10 show that AdLM is effective and outperforms existing solutions, improving accuracy over ILM by 2% on MNIST and 5% on CIFAR-10 on average.

  • Takeaways & Limitations

    AdLM offers a deep-learning privacy mechanism with epoch-independent privacy consumption and relevance-based noise redistribution aimed at improving model utility.

Abstract

from arXiv · show

In this paper, we focus on developing a novel mechanism to preserve differential privacy in deep neural networks, such that: (1) The privacy budget consumption is totally independent of the number of training steps; (2) It has the ability to adaptively inject noise into features based on the contribution of each to the output; and (3) It could be applied in a variety of different deep neural networks. To achieve this, we figure out a way to perturb affine transformations of neurons, and loss functions used in deep neural networks. In addition, our mechanism intentionally adds "more noise" into features which are "less relevant" to the model output, and vice-versa. Our theoretical analysis further derives the sensitivities and error bounds of our mechanism. Rigorous experiments conducted on MNIST and CIFAR-10 datasets show that our mechanism is highly effective and outperforms existing solutions.

I. INTRODUCTION

Deep learning increasingly operates in privacy-critical applications, while existing privacy-preserving methods face training-step, architecture, and utility constraints. The paper introduces Adaptive Laplace Mechanism (AdLM) to address these needs through epoch-independent privacy spending and relevance-based noise allocation.

  • Motivation: Deep learning’s deployment in security- and privacy-critical applications creates an urgent need for privacy-preserving mechanisms.The paper notes applications in autonomous systems, healthcare, analytics, and other settings involving sensitive information.
  • Limitations of existing methods: Existing gradient-perturbation approaches accumulate injected noise and privacy-budget consumption across training epochs.This accumulation can restrict the number of training epochs, potentially affecting model utility when longer training is needed.
  • Limitations of existing methods: Existing techniques may also inject identical noise into parameters despite differing feature contributions to model outputs.The paper uses LRP relevance estimates on MNIST to motivate adaptive rather than uniform noise allocation.
  • Research goal: The research goal is a mechanism whose privacy spending is independent of training epochs, adapts noise to feature contribution, and applies across deep neural networks.The stated goals also include applicability to varied architectures and activation functions.
  • Proposed mechanism: AdLM redistributes Laplace noise by adding more noise to less relevant features and less noise to more relevant features.It perturbs LRP relevance estimates and uses the resulting private features to distribute noise into affine transformations and loss functions.
  • Reported evidence: Experiments on MNIST and CIFAR-10 report that AdLM is effective and outperforms existing solutions.The paper presents convolutional neural networks as an example application and reports rigorous evaluations on both datasets.

B. Differential Privacy in Deep Learning

Differentially private deep learning typically perturbs training gradients, but this can accumulate privacy cost over epochs. The paper instead combines relevance propagation with adaptive perturbation of affine transformations and loss functions.

  • Deep neural networks: Deep neural networks compose parameterized layers and nonlinear activation functions to map inputs to predictions.The paper describes ReLUs and sigmoids as common activation functions and uses a loss function optimized with SGD.
  • Prior approaches: Prior private SGD methods add noise to parameter gradients at every training step, causing noise magnitude and privacy cost to accumulate with epochs.The cited approach samples batches, clips gradients, and adds Gaussian noise before updating parameters.
  • Adaptive Laplace Mechanism: AdLM makes privacy-budget consumption independent of training epochs by perturbing coefficients of affine transformations and loss functions.The mechanism is designed to learn differentially private parameters without accumulating privacy spending at each training step.
  • Relevance-based allocation: AdLM allocates more noise to features less relevant to the model output and less noise to features more relevant to it.The relevance estimates are obtained with Layer-wise Relevance Propagation, which decomposes output relevance across hidden neurons and input features.
  • Layer-wise Relevance Propagation: LRP computes each input feature’s relevance to the model outcome by propagating relevance through affine transformations across hidden layers.The decomposition uses local and global affine transformations, with a stabilizer introduced to address unboundedness.

III. ADAPTIVE LAPLACE MECHANISM (ADLM)

AdLM privatizes feature relevance, the first affine layer, and the loss function, then trains on privatized quantities without revisiting the original data. Its adaptive allocation places more noise on less relevant features.

  • Private Relevance: AdLM first computes average input-feature relevances with LRP and perturbs them using Laplace noise under privacy budget ϵ1.
  • Private Affine Transformation Layer with Adaptive Noise: The mechanism perturbs each first-layer affine transformation with adaptive Laplace noise under privacy budget ϵ2.Noise allocation is based on the privatized feature relevances.
  • Private Affine Transformation Layer with Adaptive Noise: After privatizing the first hidden layer, the mechanism stacks subsequent hidden and normalization layers without accessing additional original-data information.
  • Private Loss Function: The loss function is polynomially approximated and its coefficients are perturbed with Laplace noise under privacy budget ϵ3 before sequential SGD optimization.
  • Private Affine Transformation Layer with Adaptive Noise: More noise is assigned to features less relevant to the model output, while more relevant features receive less noise.

C. Perturbation of the Loss Function FL(θ)

AdLM protects label-dependent loss computation by approximating the loss polynomially and perturbing its coefficients, allowing training to use the privatized loss thereafter.

  • The output layer uses a polynomial approximation of the loss function to protect labels accessed during prediction.
  • Laplace noise is injected into the approximation’s polynomial coefficients to preserve ϵ3-differential privacy on each training batch.
  • The perturbed coefficients construct FL(θt), which SGD and backpropagation minimize without accessing the original labels again.
  • The loss-function computation is formally stated to preserve ϵ3-differential privacy.

D. The Correctness and Characteristics of the AdLM

Theoretical analysis establishes that AdLM preserves a composed privacy budget independent of training epochs, while adaptivity and approximation support utility and broad model applicability.

  • Algorithm 1 preserves ϵ-differential privacy with total budget ϵ = ϵ1 + ϵ2 + ϵ3.
  • The sensitivities ∆R, ∆h0, and ∆F do not depend on the number of training epochs, so privacy consumption does not accumulate across training steps.
  • The mechanism adaptively injects Laplace noise according to each feature’s contribution to the model output.
  • The average approximation error bFL(θ) is bounded by a small quantity expressed in terms of M and e.The supplied expression is fragmented across the cited passages.
  • AdLM can be applied to CNNs, deep auto-encoders, Restricted Boltzmann Machines, and convolution deep belief networks when the first affine layer can be perturbed.

IV. EXPERIMENTAL RESULTS

The experiments evaluate AdLM and pSGD with CNNs on MNIST and CIFAR-10, using the stated dataset splits and two AdLM settings.

  • Experiments use MNIST with 60,000 training examples and 10,000 test examples of 28 × 28 grayscale digit images.
  • Experiments also use CIFAR-10 with 50,000 training examples and 10,000 test examples of color images across 10 classes.
  • AdLM is compared with differentially private stochastic gradient descent using CNNs for both algorithms.
  • The mechanism is implemented in two experimental settings, including an AdLM-based CNN with ReLU activations.

A. MNIST Dataset

On MNIST, the three models share the same convolutional architecture, while AdLM and ILM outperform pSGD, especially under stronger privacy constraints and extended training.

  • A. MNIST Dataset: The three MNIST models use two convolution layers, a 25-unit fully connected layer, and a 10-class output layer with cross-entropy loss and LRN.The convolution layers have 32 and 64 features, and each hidden neuron connects to a 5x5 patch.
  • A. MNIST Dataset: AdLM and ILM outperform pSGD on MNIST, particularly when the privacy budget ϵ is small.With larger ϵ values such as 2, 4, and 8, model accuracies nearly converge because less noise is injected.
  • A. MNIST Dataset: 90.2% prediction accuracy is achieved by AdLM at ϵ = 0.25, compared with 88.46% for ILM and 82.09% for pSGD.For 0.2 ≤ ϵ ≤ 0.5, AdLM improves accuracy by 7.7% on average over pSGD, with p < 0.01.
  • A. MNIST Dataset: 93.66% prediction accuracy is achieved by AdLM after 500 epochs at ϵ = 0.5, versus 92.39% for ILM and 88.59% for pSGD.Although pSGD initially reaches 88.59%, its privacy budget accumulates each training step, whereas the proposed mechanism remains independent of epoch count.

B. CIFAR-10 Dataset

On CIFAR-10, the mechanism maintains higher accuracy than pSGD across privacy budgets and extended training, while adaptive noise redistribution further improves utility over identical-noise injection.

  • B. CIFAR-10 Dataset: The CIFAR-10 models use three convolution layers, a 30-neuron fully connected layer, and a 10-class output with cross-entropy loss and LRN.The convolution layers have 128, 128, and 256 features, using 3x3 patches in the first layer and 5x5 patches thereafter.
  • B. CIFAR-10 Dataset: The mechanism outperforms pSGD on CIFAR-10 at both modest and large privacy budgets and supports large-scale datasets because privacy spending is independent of training epochs.Figures 5a-c compare prediction accuracy against privacy budget and training epochs.
  • B. CIFAR-10 Dataset: 77% average prediction accuracy is achieved by AdLM, improving 5.9% over pSGD at 71.1%.The difference is statistically significant with p < 0.01; at ϵ = 2.5, AdLM and ILM also outperform pSGD after 800 epochs.
  • B. CIFAR-10 Dataset: AdLM improves prediction accuracy by 2% on MNIST and 5% on CIFAR-10 on average compared with ILM.The comparison is statistically significant with p < 0.05, and reflects adaptive redistribution of noise according to feature relevance.
  • B. CIFAR-10 Dataset: The proposed mechanism requires 12 extra pretraining epochs on MNIST and 50 on CIFAR-10, with pretraining taking about 10 minutes on one GPU.The pretraining computes average relevances R(D).
  • B. CIFAR-10 Dataset: The noise-injection computations are linear in database size and can run serially or in parallel, so they have little effect on computational efficiency.The passage characterizes these computations as efficient and straightforward.

APPENDIX

The appendix establishes differential privacy for relevance computation and hidden-layer transformation by analyzing neighboring datasets and injecting calibrated Laplace noise into perturbed inputs.

  • APPENDIX: The proofs analyze neighboring databases that differ in one tuple to bound perturbations in relevance values and hidden-layer computations.The relevance output R(D) is shown to preserve ϵ1-differential privacy.
  • APPENDIX: The relevance computation preserves ϵ1-differential privacy after perturbing all input features.This conclusion follows the sensitivity analysis for R(D).
  • APPENDIX: Identical Laplace noise is added to every input feature to preserve privacy in the computation of h0.The construction also treats the static bias as a zeroth input feature with an associated parameter.
  • APPENDIX: The hidden-layer output h0L(W0) preserves ϵ2-differential privacy under identical Laplace perturbation of all input features.Because the noise is identical, the differentially private relevance R(D) is unnecessary for the first affine transformation layer.

D. Proof of Lemma 5

The proof of Lemma 5 analyzes neighboring training batches and concludes that the loss computation preserves differential privacy through sensitivity-bounded perturbation of its coefficient.

  • D. Proof of Lemma 5: The proof considers two neighboring batches differing in one tuple and tracks the resulting perturbation of the loss coefficient φ(R).The analysis uses hidden-neuron states propagated through the network and the batch-level sensitivity ΔF.
  • D. Proof of Lemma 5: At zero hidden-neuron state, the per-example loss term evaluates to log 2 for either label value.This establishes the stated baseline values for q_l(0) and φ(0).
  • D. Proof of Lemma 5: The computation of F_L(θ_t) preserves ϵ3-differential privacy in Algorithm 1.The conclusion follows the sensitivity analysis for the loss over neighboring batches.

F. Approximation Error Bounds

The section analyzes the error from replacing the loss function with a second-order Taylor approximation and establishes that the resulting average error is bounded. The bound is characterized through differences between the exact and approximated objectives and depends on the number of classification outcomes.

  • The approximation error depends only on the number of possible classification outcomes M.
  • The approach truncates the Taylor expansion by removing polynomial terms of order greater than two, producing the low-order objective function in Eq. 25.
  • Lemma 7 states that the average approximation error between eFL(θ) and bFL(θ) is always bounded.
  • The error bound depends on the maximum and minimum differences between the exact and approximated loss functions.
  • The analysis covers the cross-entropy loss by examining component functions and their derivatives.

G. Corrections of the Paper

The correction updates reported experimental configurations and results, improves the pSGD comparison, and clarifies Taylor-expansion coefficient notation. It also provides a more accurate privacy-budget computation for pSGD.

  • The correction updates the reported number of layers, hidden neurons, unit patches, batch sizes, and experimental results.
  • The pSGD code release is used, improving its accuracy and making its privacy-budget computation more accurate.
  • The correction replaces the coefficient equations after Eq. 25 with a more detailed explanation to clarify Taylor-expansion coefficients.
  • The revised notation distinguishes first-order and second-order coefficients of the approximated objective function bFL(θ).
Loading 1709.05750v2…