PaperlayerView exact revision on arXiv

Source-linked AI summary

Generating Artificial Data for Private Deep Learning

Aleksei Triastcyn, Boi Faltings

arXiv:1803.03148v3cs.LGcs.CRstat.ML

TL;DR

Machine-learning models can expose details of sensitive training data, while model-release approaches may limit flexibility. This paper uses GANs to release artificial data and estimates privacy loss after generation; the authors report useful learning performance and bounded expected privacy loss, with a differential-privacy layer for the critic improving privacy bounds and generated-image quality and diversity.

  • Problem

    Models can capture fine details of training data, creating a risk that individual examples may be recovered; the paper seeks to preserve ML utility while protecting sensitive information and quantifying disclosure risk.

    Source: §1 · p. 1

  • Method

    The paper trains GANs to produce artificial datasets in place of real data, estimates privacy loss through ex post analysis, and adds a differential privacy layer to the critic.

    Source: §4 · p. 3, §4.2 · p. 3, §4.1 · p. 3

  • Results

    Student models achieve high accuracy on MNIST and SVHN, expected privacy loss is bounded by single-digit values, and face detection in the inversion attack drops from 63.6% to 1.3%.

    Source: §6 · p. 7

  • Takeaways & Limitations

    Artificial data can support training and validation without assuming access to similar publicly available data.

    Source: §6 · p. 7

    The ex post expected-privacy-loss bounds are not equivalent to traditional differential privacy and concern only a given dataset.

    Source: §4.3 · p. 4

Abstract

from arXiv · show

In this paper, we propose generating artificial data that retain statistical properties of real data as the means of providing privacy with respect to the original dataset. We use generative adversarial network to draw privacy-preserving artificial data samples and derive an empirical method to assess the risk of information disclosure in a differential-privacy-like way. Our experiments show that we are able to generate artificial data of high quality and successfully train and validate machine learning models on this data while limiting potential privacy loss.

1 Introduction

The introduction frames a tension between using machine learning on sensitive data and the risk that models can reveal training examples. It proposes releasing artificial datasets instead of real data, aiming to preserve ML utility while protecting information and estimating privacy risk.

1 Introduction

  • Models can capture fine-grained training details, and prior work suggests individual examples may be recovered even without access to model parameters.The paper identifies training-set recovery as a privacy risk as ML use expands.Source: §1 · p. 1
  • Model release can restrict future flexibility, while releasing data supports training different models, pooling sources, and research transparency.The introduction also notes that model release methods may assume access to similar public data, which may be unavailable in areas such as medicine.Source: §1 · p. 1
  • The proposed approach uses GANs to create artificial datasets for training, enabling data release without requiring similar public data or a complex distributed architecture.The introduction presents data release as more flexible than releasing a single trained model.Source: §1 · pp. 1–2, Figure 1 · p. 1
  • The paper proposes a statistical framework for estimating potential privacy loss and reports learning performance comparable to model release methods and resilience to model inversion attacks.The authors identify these as contributions of the paper.Source: §1 · p. 2

2 Related Work

Related work covers attacks that can expose training data, privacy-preserving model release, and synthetic-data approaches. The paper positions its GAN approach against methods that rely on seeds or gradient noise and notes practical limits for complex data.

2 Related Work

  • Model inversion and membership inference can operate in a black-box setting, without access to a model’s internal parameters.Model inversion reconstructs inputs from output probabilities; membership inference predicts whether an example appeared in training.Source: §2 · p. 2
  • Model-release methods include distributed training, teacher ensembles, and DP-SGD, but some require public data or incur high privacy loss.The related-work discussion notes that DP-SGD can maintain low DP bounds but may require public-data pre-training.Source: §2 · p. 2
  • Prior synthetic-data methods use probabilistic models, GANs, or DP-SGD, but can be limited by complex-data costs, predefined private attributes, or unstable noisy training.The paper says noise scales with the square root of the number of model parameters, complicating training on more complex datasets.Source: §2 · p. 2
  • The proposed GAN approach uses neither real seeds nor gradient noise, and the authors report empirical single-digit bounds on expected privacy loss.The paper contrasts this with prior approaches and says its generated samples are experimentally sufficiently different from real data.Source: §2 · p. 2

3 Preliminaries

The preliminaries introduce differential privacy and privacy loss, then set out probability and information-theoretic tools used in privacy estimation.

3 Preliminaries

  • Approximate differential privacy bounds an outcome’s probability under one input by its probability under an adjacent input, scaled by e^ε with additive δ.The definition applies to every pair of adjacent inputs and every outcome.Source: §3 · p. 2
  • The Gaussian noise mechanism adds Gaussian noise to a function’s output to achieve (ε, δ)-differential privacy.Source: §3 · p. 3
  • KL divergence between mechanism-output distributions equals the expected privacy-loss random variable.The preliminaries introduce KL divergence for continuous distributions and connect it to privacy loss.Source: §3 · p. 3
  • For privacy estimation, Chebyshev’s inequality supplies tail bounds, with a semi-variance version used for an expected asymmetric distribution.The paper uses this version to obtain a sharper bound.Source: §3 · p. 3

4 Our Approach

The approach releases artificial data in place of real training data and estimates expected privacy loss from generated data. Its critic modification improves sample properties, while the estimator and GAN assumptions limit the scope of its guarantees.

4 Our Approach

  • The approach uses artificial data for learning and publishing instead of real data, limiting information leakage to artificial samples.The motivation is to reduce exposure of real data during training.Source: §4 · p. 3

4.1 Differentially Private Critic

  • The DP critic clips and noises the discriminator’s penultimate-layer activations, but this does not transfer the same DP guarantee to generator parameters for WGAN-GP.The authors note this limitation applies to practically all existing GAN versions.Source: §4.1 · p. 3
  • The DP critic improves sample diversity, reduces similarity to real data, permits longer training for higher-quality samples, and significantly improves conditional generation.Source: §4.1 · p. 3

4.2 Privacy Estimation Framework

  • To avoid costly GAN retraining, the estimator simulates removal by deleting the k nearest artificial neighbours of a sampled real example, with k chosen heuristically.The simulation assumes a properly trained GAN without mode collapse; k is selected using KL divergence between real and artificial distributions.Source: §4.2 · pp. 3–4
  • The framework estimates expected privacy loss with high-dimensional KL divergence and uses Chebyshev’s inequality to bound the probability that loss exceeds threshold µ.The KL estimator is described as converging almost surely to the true divergence; a sample inequality can address insufficient samples at the cost of looser bounds.Source: §4.2 · p. 4

4.3 Limitations

  • The estimator’s removal simulation depends on heuristics and the similarity metric, which may yield unrepresentative samples and poor guarantees.Source: §4.3 · p. 4
  • The ex post bounds concern a given dataset and are not traditional DP; GAN instability and mode collapse also make adaptation beyond image data difficult.The authors identify possible use when strict privacy guarantees are not required or when expected rather than worst-case loss is of interest.Source: §4.3 · p. 4

5 Evaluation

The evaluation tests whether models trained on generated data retain learning utility and whether the data limit privacy risks, using MNIST, SVHN, and CelebA. Generated data achieve learning performance comparable to or better than PATE, while privacy analyses report bounded expected loss and reduced information in model-inversion reconstructions.

5.1 Experimental Setting

  • The evaluation trains a teacher on original training data, uses it to generate data for student models, and tests students on held-out real data.Experiments cover MNIST, SVHN, and CelebA; student models need not be neural networks.Source: §5 · p. 4, §5.1 · p. 4

5.3 Learning Performance

  • Artificial data achieves 98.3% accuracy on MNIST and 87.7% on SVHN, comparable to or better than corresponding PATE results.Table 1 compares test accuracy with a non-private baseline and PATE.Source: Table 1 · p. 4, §5.3 · p. 5

5.2 Implementation Details

  • The experiments use a conditional WGAN-GP; its DP critic clips a 64-dimensional feature vector to C = 1 and adds Gaussian noise with σ = 1.5.Class labels condition generation, enabling labelled artificial datasets for supervised learning.Source: §5.2 · pp. 4–5

5.4 Privacy Analysis

  • Reconstructions from models trained on artificial data conceal most specific facial features; detection succeeded in 1.3% of cases and recognition in 0.3%.Non-private-model detection and recognition rates were 63.6% and 11%; both DP rates were 0%.Source: Figure 2 · p. 5, Table 3 · p. 5, §5.4 · p. 6
  • As µ increases on the MNIST privacy-accuracy curve, model accuracy and reconstruction quality also increase.The plotted reconstructions correspond to points on the curve.Source: Figure 3 · p. 5, §5.4 · p. 6

5.3 Learning Performance

  • Artificial-data validation losses correlate with real-data validation losses at 0.7197–0.9972 for MNIST and 0.8047–0.9810 for SVHN.A logistic-regression model trained on artificial MNIST samples achieved 91.69% accuracy versus 92.58% on original data.Source: §5.3 · pp. 5–6

5.4 Privacy Analysis

  • The estimated expected privacy-loss bound µ is lower with a DP critic in all cases, but µ is not an empirical estimate of differential-privacy ε.The experiments fix γ, the probability of exceeding µ, at 10−5.Source: Table 2 · p. 4, §5.4 · p. 6
  • Generated and closest-real image pairs are visually similar overall but differ in details, including digit attributes and facial features.For CelebA, pose and lighting may be similar while gender, skin colour, and facial features often differ.Source: Figure 5 · p. 6, §5.4 · p. 6

6 Conclusions

The paper studies private release of complex, high-dimensional data through GAN-generated artificial datasets. It reports utility on MNIST and SVHN and bounded expected privacy loss, with a differential-privacy layer for the critic improving privacy bounds and generated-image quality and diversity.

6 Conclusions

  • The study targets private data release for complex, high-dimensional data rather than the commonly studied model-release setting.The paper notes potential applications including pooling data from multiple sources, simpler development, and data trading.Source: §6 · p. 7
  • Student models trained on artificial data achieved high accuracy on MNIST and SVHN, and models could also be validated on artificial data.The GAN approach does not assume access to similar publicly available data.Source: §6 · p. 7
  • Face-detection attack success fell from 63.6% to 1.3% with GAN training, while attack success correlated with estimated privacy bounds.Expected privacy loss for WGAN-GP samples was bounded by single-digit values.Source: §6 · p. 7
  • A differential-privacy layer for the critic improves privacy-loss bounds and provides DP guarantees for critic outputs.The layer also acts as a regularizer, improving training stability and generated-image quality and diversity.Source: §6 · p. 7
  • The paper identifies differential-privacy guarantees for generative models that preserve utility as a major direction for future work.It also proposes improving privacy estimation, including bounds on maximum privacy loss.Source: §6 · p. 7
Loading 1803.03148v3…