PaperlayerView exact revision on arXiv

Source-linked AI summary

Tempered Sigmoid Activations for Deep Learning with Differential Privacy

Nicolas Papernot, Abhradeep Thakurta, Shuang Song, Steve Chien, Úlfar Erlingsson

arXiv:2007.14191v1stat.MLcs.CRcs.LG

TL;DR

Differentially private learning can lose accuracy because DP-SGD clips and noises large gradients, while standard architectures use unbounded activations. This paper designs architectures for private training with bounded tempered sigmoids, showing improved privacy/accuracy trade-offs and state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10.

  • Problem

    Differentially private learning often has lower test accuracy than non-private learning, and exploding activations make DP-SGD’s gradient clipping and noise less effective.

  • Method

    The paper incorporates private-learning considerations into architecture selection by replacing unbounded ReLU activations with bounded tempered sigmoids and analyzing their interaction with DP-SGD clipping.

  • Results

    98.1% test accuracy on MNIST at (ε, δ) = (2.93, 10^-5) exceeded the previous 96.6% result, alongside improvements on FashionMNIST and CIFAR10.

  • Takeaways & Limitations

    Choosing activation functions explicitly for privacy-preserving training substantially improves privacy/accuracy trade-offs across MNIST, FashionMNIST, and CIFAR10.

  • Takeaways & Limitations

    The authors report that experiments with the tempered loss of prior work did not improve DP-SGD training.

Abstract

from arXiv · show

Because learning sometimes involves sensitive data, machine learning algorithms have been extended to offer privacy for training data. In practice, this has been mostly an afterthought, with privacy-preserving models obtained by re-running training with a different optimizer, but using the model architectures that already performed well in a non-privacy-preserving setting. This approach leads to less than ideal privacy/utility tradeoffs, as we show here. Instead, we propose that model architectures are chosen ab initio explicitly for privacy-preserving training. To provide guarantees under the gold standard of differential privacy, one must bound as strictly as possible how individual training points can possibly affect model updates. In this paper, we are the first to observe that the choice of activation function is central to bounding the sensitivity of privacy-preserving deep learning. We demonstrate analytically and experimentally how a general family of bounded activation functions, the tempered sigmoids, consistently outperform unbounded activation functions like ReLU. Using this paradigm, we achieve new state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10 without any modification of the learning procedure fundamentals or differential privacy analysis.

1 Introduction

Differentially private learning loses utility when per-example gradients become too large and clipping discards signal before noise is added. The paper proposes choosing bounded tempered sigmoid activations specifically for private training and reports improved privacy–accuracy tradeoffs across three benchmarks.

  • Motivation: DP-SGD clips each per-example gradient and adds Gaussian noise, creating an artificial noise floor that makes sensitivity control central to private learning.Sensitivity measures how much one training point can affect model outputs.
  • Motivation: Exploding activations increase unclipped gradient magnitudes, causing clipping-related information loss and amplifying the utility damage from calibrated noise.The paper argues this differs from the regularization benefits often associated with batch-level gradient clipping.
  • Approach: Tempered sigmoids are proposed as bounded activations whose scaling can control gradient norms and reduce the negative effects of clipping and noise.The approach selects architectures for private learning rather than adapting non-private architectures afterward.
  • Approach: Analysis and experiments report that tempered sigmoids significantly improve private-learning suitability and privacy–accuracy tradeoffs relative to ReLU activations.The paper concludes that tempered sigmoids are a better default activation choice for private ML.
  • Results: 86.1% test accuracy is obtained on FashionMNIST versus 81.9%, while CIFAR10 reaches 66.2% versus 61.6% under the stated privacy settings.These results are reported as advances over prior privacy-preserving benchmarks.

2 Training-data Memorization, Differential Privacy, and DP-SGD

Training-data memorization can expose sensitive information, motivating differential privacy as a formal protection framework. DP-SGD limits each example’s influence through per-example gradient clipping and calibrated Gaussian noise.

  • Training-data memorization: Machine learning models can memorize and disclose sensitive training data, including through membership inference and secret extraction attacks.The concern is especially relevant when models analyze personal or sensitive data.
  • Differential privacy: Differential privacy requires similar outputs for datasets differing in one record, with ε bounding privacy loss and δ allowing a small failure probability.Lower ε represents a stronger formal privacy guarantee.
  • Differential privacy: Differential-privacy guarantees apply to all attackers and remain valid under composition and arbitrary post-processing.These properties make the guarantees robust to attacker knowledge and downstream use of outputs.
  • DP-SGD: DP-SGD computes per-example gradients, clips each to a fixed maximum ℓ2 norm, and adds Gaussian noise to the averaged gradients.This procedure bounds the learning process’s sensitivity to individual training examples.

3 Approach

The approach replaces unbounded activations with tempered sigmoids to control activation and gradient magnitudes during DP-SGD, reducing clipping-related information loss and privacy noise. The temperature parameter provides an additional control over gradient norms and clipping behavior.

  • DP-SGD sensitivity control: Per-example gradients are computed individually and clipped so their total l2 norm across parameters is bounded by C.This bounds the influence of each training example in DP-SGD.
  • Motivation for tempered sigmoids: Bounded activations are proposed to prevent exploding activations, keeping gradients smaller so DP-SGD discards less signal through clipping.The expected consequence is higher test performance at a fixed privacy guarantee.
  • Tempered sigmoids: Tempered sigmoids replace unbounded neural-network activations with a general bounded family designed for private learning.The paper also notes that tempered losses were previously studied for robustness to training noise.
  • Related approach: The tempered loss of prior work was tested but did not improve DP-SGD training.This distinguishes the proposed activation-based approach from the related tempered-loss idea.
  • Tempered sigmoids: The parameters s, T, and o control activation scale, inverse temperature, and offset; s = 2, T = 2, and o = 1 yields tanh exactly.Decreasing s reduces neuron activation magnitude, while T rescales weighted inputs.
  • Clipping control: DP-SGD clipping trades bias against variance: low C changes the optimized objective, whereas high C increases Gaussian noise variance.The noise variance is stated as σ2 = M2C2, where M is the noise multiplier.
  • Gradient-norm control: The inverse temperature T acts as a knob for controlling loss-gradient norms and can be chosen to avoid clipping issues.For binary logistic loss, T directly controls gradient norm and can act like feature scaling for grossly misclassified points.
  • Gradient-norm control: For multiclass logistic loss, each class-specific partial gradient has norm at most |T|·∥x∥2, yielding a corresponding bound for the full gradient.The bound follows because the parenthesized expression in the partial gradient has norm smaller than 1.

4 Experimental Setup

The experiments evaluate tempered sigmoid activations against ReLU on MNIST, FashionMNIST, and CIFAR10 under DP-SGD, using the established convolutional architectures and practical JAX implementations.

  • Datasets and baselines: Experiments use MNIST, FashionMNIST, and CIFAR10, three benchmarks where achieving high utility under strong privacy guarantees remains difficult.Prior reported test accuracies were 96.6% on MNIST at (ε, δ) = (2.93, 10^-5), 81.9% on FashionMNIST, and 61.6% on CIFAR10 at (ε, δ) = (7.53, 10^-5).
  • Datasets and baselines: ReLU models reproduce previous state-of-the-art results on all three datasets before tempered sigmoid activations are substituted.The tempered sigmoid replaces ReLU in the convolutional and fully-connected layers while preserving the reported architectures.
  • Implementation: The tempered sigmoid implementation uses a JAX scalar function with scale, inverse temperature, and offset parameters.The function applies expit to inverse-temperature-scaled inputs, then multiplies by scale and subtracts offset.
  • Implementation: The activation is wrapped with an elementwise layer for use in the neural-network architectures.The included implementation applies the scalar function elementwise to inputs.

5 Evaluating the family of tempered activation functions

Experiments evaluate tempered-sigmoid parameters, compare tempered sigmoids and tanh against ReLU under DP-SGD, and examine activation norms and tuning. Tempered sigmoids consistently improve privacy-utility performance across MNIST, FashionMNIST, and CIFAR10.

  • 5.1 Improved privacy-utility tradeoffs with tempered sigmoids: The strongest tempered-sigmoid settings form a parameter cluster, with average triplets near (s, T, o) = (2, 2, 1) on MNIST and FashionMNIST.The triplets are (1.97, 2.27, 1.15), (2.27, 2.61, 1.28), and (1.58, 3.00, 0.71) for MNIST, FashionMNIST, and CIFAR10.
  • 5.2 Improving the state-of-the-art on MNIST, FashionMNIST, and CIFAR10 with tanh: Tanh, obtained with s = 2, T = 2, and o = 1, reproduces the positive results of the broader tempered-sigmoid family without introducing new hyperparameters.Tanh reaches 98.0% on MNIST, 85.5% on FashionMNIST, and 63.84% on CIFAR10, and outperforms ReLU consistently across privacy loss.
  • 5.2 Improving the state-of-the-art on MNIST, FashionMNIST, and CIFAR10 with tanh: Under DP-SGD, ReLU activation norms explode by a factor of 3 relative to non-private ReLU, whereas tanh returns them to comparable levels.Lower activation norms make unclipped gradients closer to the clipping norm and better matched to the noise scale, reducing information loss from clipping and noise.
  • 5.2 Improving the state-of-the-art on MNIST, FashionMNIST, and CIFAR10 with tanh: With jointly fine-tuned hyperparameters, tanh-based tempered sigmoids retain higher accuracy than ReLU: 98.1% versus 96.6%, 86.1% versus 81.9%, and 66.2% versus 61.6%.These comparisons correspond to MNIST, FashionMNIST, and CIFAR10, respectively, in each method’s individually best setting.

6 Conclusions

The paper selects architectures for private learning from the outset rather than retrofitting non-private architectures. Tempered sigmoids improve privacy-accuracy tradeoffs on three challenging benchmarks, while layer-wise parameter choices remain open for other tasks.

  • 6 Conclusions: The paper directly incorporates private-learning requirements into activation-function selection instead of first training a non-private model and later making it private.This architecture-first approach is applied to differential privacy on MNIST, FashionMNIST, and CIFAR10.
  • 6 Conclusions: Tempered sigmoids substantially improve state-of-the-art privacy-accuracy tradeoffs on MNIST, FashionMNIST, and CIFAR10.The paper suggests that other architectural aspects may further reduce the performance gap between private and non-private learning.
  • 6 Conclusions: Sharing tempered-sigmoid parameters across layers was not necessary, but layer-wise parameters did not improve results on the evaluated datasets and may matter for different tasks.This leaves layer-wise parameterization as a scope boundary for future investigation.

Broader impact

The work is presented as a practical contribution for designing privacy-preserving deep-learning architectures. Its conclusions are intended to support choices in real-world pipelines involving sensitive datasets.

  • Broader impact: The analysis and experiments are intended to help practitioners choose neural architectures for privacy-preserving deep learning.The paper states that these conclusions can be applied in real-world machine-learning pipelines.
  • Broader impact: The authors expect a generally positive broader impact because machine learning has numerous applications to sensitive datasets.
Loading 2007.14191v1…