PaperlayerView exact revision on arXiv

Source-linked AI summary

Differentially Private Learning Needs Better Features (or Much More Data)

Florian Tramèr, Dan Boneh

arXiv:2011.11660v3cs.LGcs.CRstat.ML

TL;DR

Differentially private learning often lags behind shallow methods on canonical vision tasks, raising the question of what resources are needed to surpass handcrafted features. The paper evaluates handcrafted and transferred features with private classifiers and finds that more private data or related public data can overcome their advantage. It concludes that these features provide strong baselines for evaluating private deep learning.

  • Problem

    End-to-end differentially private deep learning suffers substantial utility losses, motivating whether handcrafted features can improve private learning on canonical vision benchmarks.

  • Method

    The paper trains private classifiers on data-independent ScatterNet features and studies whether larger private datasets or related public data enable stronger private models.

  • Results

    Private handcrafted-feature models outperform end-to-end deep models on MNIST, Fashion-MNIST and CIFAR-10, while transfer learning reaches 92.7% CIFAR-10 accuracy at ε = 2 using public ImageNet data.

  • Takeaways & Limitations

    Higher-quality handcrafted or transferred features are especially important for improving private classifiers when private data is limited.

  • Takeaways & Limitations

    The analysis does not account for privacy leakage from hyper-parameter search, following prior work despite acknowledging that fully accounting for this leakage is difficult.

Abstract

from arXiv · show

We demonstrate that differentially private machine learning has not yet reached its "AlexNet moment" on many canonical vision tasks: linear models trained on handcrafted features significantly outperform end-to-end deep neural networks for moderate privacy budgets. To exceed the performance of handcrafted features, we show that private learning requires either much more private data, or access to features learned on public data from a similar domain. Our work introduces simple yet strong baselines for differentially private learning that can inform the evaluation of future progress in this area.

1 INTRODUCTION

The paper asks whether handcrafted features can improve differentially private learning, motivated by the utility losses of end-to-end private deep networks. It finds that handcrafted or public-domain features improve private performance, while end-to-end models require substantially more private data to surpass them.

  • Motivation: Differentially private deep networks incur significant utility costs and can underperform shallow methods on canonical vision benchmarks.On CIFAR-10, a prior private neural network reached 66.2% accuracy at ε = 7.53, while non-private linear models with handcrafted features achieved higher accuracy.
  • Contributions: The paper introduces strong handcrafted-feature baselines that improve privacy-utility guarantees on MNIST, Fashion-MNIST and CIFAR-10.The baselines use ScatterNet features with linear or deeper private models.
  • Contributions: 130×: On CIFAR-10, a ScatterNet-based model exceeds Papernot et al.’s accuracy while improving the provable DP guarantee by 130×.The comparison is reported for the same task and is presented as a simultaneous accuracy and privacy improvement.
  • Contributions: Handcrafted-feature models outperform end-to-end deep models despite having more trainable parameters.The paper explains this through faster convergence of non-private learning at low learning rates, which translates into better private accuracy for a fixed privacy budget.
  • Data and public features: About an order of magnitude more private training data is needed for end-to-end deep models to outperform handcrafted-feature baselines on CIFAR-10.The result uses an additional 500,000 labeled Tiny Images to study private end-to-end learning.
  • Data and public features: 92.7% accuracy: With public unlabeled ImageNet data, private transfer learning reaches this CIFAR-10 accuracy at ε = 2.The paper describes strong privacy as coming at only a minor accuracy cost in this setting.

2 STRONG SHALLOW BASELINES FOR DIFFERENTIALLY PRIVATE LEARNING

The paper studies ScatterNet as a data-independent feature extractor for private classifiers, using private optimization only on the model trained atop those features. Feature normalization and DP-SGD are central to the baseline design.

  • SCATTERNET CLASSIFIERS: ScatterNet encodes natural-image priors, including invariance to small rotations and translations, through a cascade of wavelet transforms.Because the transform is data independent, the classifier on top can be privately fine-tuned without privatizing the feature extraction.
  • DIFFERENTIALLY PRIVATE TRAINING: The private classifier is trained with DP-SGD after independently preprocessing each sample with ScatterNet.DP-SGD samples batches, clips gradients to norm C, and adds Gaussian noise with variance σ^2C^2/B^2 to the mean gradient.
  • NORMALIZATION: Feature normalization is crucial for strong performance, with group normalization and data normalization providing the two considered approaches.Group normalization operates independently per data point, whereas data normalization privately estimates training-set channel means and variances.
  • NORMALIZATION: Normalization significantly accelerates convergence of non-private linear models trained on ScatterNet features across MNIST, Fashion-MNIST and CIFAR-10.For CIFAR-10, data normalization performs significantly better than group normalization, despite its small privacy cost when used privately.
  • RESULTS: The normalized ScatterNet models exceed previously reported differentially private neural-network results, although their maximal test accuracy remains below state-of-the-art CNNs.The comparison is made across the benchmark settings described for these models.

3 EVALUATING PRIVATE SCATTERNET CLASSIFIERS

The evaluation compares private ScatterNet classifiers and CNNs across privacy budgets, using matched hyperparameter searches and repeated-run accuracy measurements. ScatterNet-based models achieve stronger privacy-utility results and are more robust to hyperparameter choices, although end-to-end CNNs can eventually win with weaker privacy guarantees.

  • Experimental setup: ScatterNet classifiers are compared with CNNs on MNIST, Fashion-MNIST, and CIFAR-10 without changing the DP-SGD algorithm.The evaluation uses grid searches and compares against the CNN models of Papernot et al. (2020b).
  • Experimental setup: The search targets (ε = 3, δ = 10−5), fixes gradient clipping at C = 0.1, and varies training epochs, batch sizes, and learning rates.Group Normalization and private data normalization are also evaluated.
  • Results: 66.2% CIFAR-10 accuracy at ε = 7.53 is matched by a ScatterNet classifier at ε = 2.6, improving the DP guarantee by e4.9 ≈134.On MNIST, ScatterNet matches PATE’s 98.5% accuracy at ε = 1.97 without requiring public data.
  • Results: ScatterNet models are more robust to hyperparameter changes: on CIFAR-10, their worst configuration beats the best end-to-end CNN, while their MNIST and Fashion-MNIST medians also outperform the best CNNs.Table 3 reports minimum, maximum, median, and MAD accuracies at (ε = 3, δ = 10−5).
  • Results: CNNs trained on ScatterNet features also improve private deep-model utility, while remaining less sensitive to hyperparameters than end-to-end CNNs.On MNIST and Fashion-MNIST, deeper models have little room to improve because linear ScatterNet models are already close to state-of-the-art non-private accuracy.
  • Results: End-to-end CNNs can outperform ScatterNet models without privacy, but on CIFAR-10 ScatterNet classifiers still outperform them at ε = 7.53.The paper notes that surpassing handcrafted features at small privacy budgets may require improvements beyond tighter DP-SGD analysis.

4 HOW DO HANDCRAFTED FEATURES HELP?

Handcrafted features outperform end-to-end CNNs under privacy because they create a simpler learning task that converges faster, not because their models are smaller. This advantage is tied to the interaction between gradient noise and learning-rate choice.

  • Model dimensionality: The utility gap is not explained by model dimensionality: ScatterNet can outperform CNNs despite having more trainable parameters.For CIFAR-10, the smaller CNN has approximately as many parameters as the linear ScatterNet model.
  • Convergence: Handcrafted-feature models converge faster without privacy, while DP-SGD requires learning rates roughly an order of magnitude lower than noiseless clipped SGD.The same gradient-clipping norm is used in the noisy and noiseless comparisons.
  • Gradient noise: With a high learning rate, noise vastly degrades performance, whereas at a low learning rate convergence is similar with or without noise.Figure 3 compares ScatterNet classifiers and end-to-end CNNs on CIFAR-10 under both learning-rate regimes.
  • Interpretation: ScatterNet benefits private learning by making training converge rapidly even with the small update steps required to average out gradient noise.The paper identifies faster convergence as the mechanism behind the utility advantage.
  • Future directions: Faster non-private convergence may translate into better private learning, motivating adaptive updates and private second-order optimization as future directions.The paper also identifies more training steps, enabled by larger datasets at fixed privacy budget, as another avenue.

5 TOWARDS BETTER PRIVATE DEEP LEARNING

The paper studies two paths to stronger private deep learning on CIFAR-10: more private training data and features learned from public image data. More private data can eventually let CNNs surpass handcrafted features, while public-domain features provide strong private transfer performance.

  • More private data: Increasing the private dataset size permits more DP-SGD steps or less noise per step for a fixed privacy budget ε.The reported best-performing models use more steps and higher learning rates as dataset size increases.
  • More private data: About an order-of-magnitude more private training data is needed for end-to-end CNNs to outperform ScatterNet features.The experiment uses subsets from 10,000 to 550,000 examples and evaluates a fixed budget of ε = 3, δ = 1/2N.
  • Transfer learning: 80.0% accuracy is achieved at ε = 2, δ = 10^-5 by privately training a linear model on features from a CIFAR-100-trained ResNeXt.The corresponding non-private linear model reaches 84% accuracy on CIFAR-10.
  • Transfer learning: The transfer results indicate that better source models transfer better under differential privacy, with source-model choice explaining much of the gap over prior work.The paper compares the CIFAR-100 transfer result with prior accuracies of 67% and 72% in the same privacy setting.
  • Transfer learning: 92.7% accuracy is achieved at ε = 2, δ = 10^-5 using features from a SimCLR model trained on unlabeled ImageNet.A non-private linear model on these features reaches 95% accuracy on CIFAR-10.

6 CONCLUSION AND OPEN PROBLEMS

The paper concludes that handcrafted features can improve private learning by encoding domain priors, while more private data or related public data can surpass them. It also identifies accelerated convergence and federated learning as directions for future work.

  • Private ScatterNet classifiers outperform end-to-end CNNs on MNIST, Fashion-MNIST and CIFAR-10.
  • Handcrafted features can be surpassed with either a larger private training set or a public dataset from a related domain.
  • Improving DP by accelerating convergence: Reducing the number of private training steps may improve DP even if computational cost increases.The paper identifies slow convergence of end-to-end deep models as a limiting factor.
  • Federated learning: The techniques may extend from centralized DP training to decentralized schemes such as Federated Learning.The paper notes that DP can significantly degrade performance in some federated settings.
  • Handcrafted features for ImageNet and non-vision domains: Handcrafted features may help private ImageNet learning by accelerating CNN convergence, although linear classifiers are unlikely to be competitive there.

A WHY SCATTERNETS?

The paper uses ScatterNet features as a shallow basis for private vision classifiers and contrasts them with other shallow approaches. Unsupervised feature dictionaries involve many preprocessing and modeling steps, while nonlinear private kernels are generally intractable.

  • ScatterNet features provide the basis for shallow differentially private vision classifiers.The paper briefly discusses other shallow approaches but considers them less suitable for private learning.
  • Unsupervised feature dictionaries: Unsupervised feature dictionaries can support strong CIFAR-10 linear classifiers but rely on normalization, whitening, GMM modifications, feature selection and other steps.Coates and Ng report above 80% test accuracy on CIFAR-10 with this approach.
  • Kernel Machines: Private learning with nonlinear kernels is generally intractable, motivating kernel approximations using random features.

B DP-SGD, RDP AND PRIVATE DATA NORMALIZATION

The paper combines data-independent ScatterNet transforms with private optimization and analyzes privacy through Rényi differential privacy. Private normalization is composed with DP-SGD before conversion to an (ε, δ)-DP guarantee.

  • DP-SGD: DP-SGD samples each training example independently, computes per-sample gradients, clips them, and adds noise to the average gradient.The supplied passages identify the inputs and sampling and gradient-computation steps; the noise-addition passage is partial.
  • RDP accounting: RDP privacy loss is evaluated across training steps using adaptive composition, then converted from RDP to an (ε, δ)-DP guarantee.
  • Private Data Normalization: PrivDataNorm privately estimates per-channel means and variances before DP-SGD to normalize ScatterNet features and improve convergence.The procedure clips each sample’s per-channel means and uses the Gaussian mechanism for private estimation.
  • Scattering networks: ScatterNet applies wavelet transforms, complex moduli and spatial averaging to produce approximately dimension-preserving features.The output tensor has dimension (K, H/2^J, W/2^J), with K/2^2J = O(1).
  • Scattering networks: The default depth-two ScatterNet uses wavelets at eight angles and outputs (K, H/4, W/4), with K = 81 for grayscale and K = 243 for RGB images.

C.2 MODEL ARCHITECTURES

The paper compares linear ScatterNet classifiers, CNNs fine-tuned on ScatterNet features, and end-to-end CNNs under DP-SGD. The architectures and training experiments vary model size, normalization, privacy, and hyper-parameters across canonical vision tasks.

  • Linear ScatterNet Classifiers: Linear ScatterNet classifiers train logistic regression on features of size (81, 7, 7) for MNIST and Fashion-MNIST and (243, 8, 8) for CIFAR-10.
  • End-to-end CNNs: End-to-end CNNs use small Tanh-based architectures adapted from prior DP-SGD work because DP-SGD noise grows with model dimensionality.
  • ScatterNet CNNs: CNNs fine-tuned on ScatterNet features use smaller models because the transformed feature vectors are larger than the input images.For CIFAR-10, reducing network depth from 8 to 3 yields approximately the parameter count of the linear ScatterNet model.
  • Feature normalization: Feature normalization is evaluated by comparing unnormalized, Data Normalization, and Group Normalization variants on ScatterNet features.The Group Normalization comparison uses group counts G ∈ {9, 27, 81}.
  • Model comparisons: Without privacy, ScatterNet linear models and CNNs perform similarly on MNIST and Fashion-MNIST, while CNNs perform slightly better on CIFAR-10.The end-to-end CNN performs slightly worse than the linear model on Fashion-MNIST.
  • Training setup: All experiments use DP-SGD with momentum and omit data augmentation, weight decay, and other explicit anti-overfitting mechanisms.The paper treats differential privacy as a powerful regularizer.
  • Experimental setup: The experiments search hyper-parameters for privacy-utility comparisons, convergence-rate analyses, and training-set-size evaluations.Some best-performing hyper-parameters lie at the search-range boundary, without a significant upward trend when ranges are expanded.

C.7 PRIVATE LEARNING ON LARGER DATASETS

The section evaluates private learning as the dataset grows, using augmented CIFAR-10 datasets and retuned hyper-parameters. Larger datasets support better accuracy when models train for more steps and use higher learning rates.

  • C.7 PRIVATE LEARNING ON LARGER DATASETS: The study adds 500K labeled Tiny Images and constructs datasets ranging from N ∈ {10K, 25K, 50K, 100K, 250K, 550K}.The additional data complement CIFAR-10 only when N > 50K.
  • C.7 PRIVATE LEARNING ON LARGER DATASETS: The augmented Tiny Images do not entirely match CIFAR-10, but non-private training on datasets larger than 50K does not reduce test accuracy.This distribution mismatch is reported alongside the observed non-private accuracy result.
  • C.7 PRIVATE LEARNING ON LARGER DATASETS: For each training-set size, the models are retrained with a hyper-parameter search while selected parameters are fixed to limit computational cost.Data Normalization statistics use only original CIFAR-10 samples, and PrivDataNorm privacy is analyzed with Rényi DP.
  • C.7 PRIVATE LEARNING ON LARGER DATASETS: As dataset size increases, better accuracy comes from training for more steps and using higher learning rates.Figure 4 reports final accuracy for the best-performing models.

C.8 EVALUATION OF PRIVATE TRANSFER LEARNING

The section evaluates private linear classifiers using features transferred from public-domain models. It extracts penultimate-layer features from CIFAR-100 and unlabeled ImageNet models, then trains private classifiers with DP-SGD.

  • C.8 EVALUATION OF PRIVATE TRANSFER LEARNING: Transfer learning uses a ResNeXt-29 pretrained on CIFAR-100 and a ResNet-50 trained on unlabeled ImageNet with SimCLRv2.These models provide features learned from related or broader image domains.
  • C.8 EVALUATION OF PRIVATE TRANSFER LEARNING: The private linear classifiers use penultimate-layer features with dimensions 1024 for ResNeXt and 4096 for SimCLRv2 ResNet.The extracted features are trained with DP-SGD without feature normalization.
  • C.8 EVALUATION OF PRIVATE TRANSFER LEARNING: The supplementary Tiny Images subset was selected to match CIFAR-10 labels and is described as unlikely to contain offensive content after the full dataset’s withdrawal.The withdrawal followed discovery of offensive class labels in the full Tiny Images dataset.
  • C.8 EVALUATION OF PRIVATE TRANSFER LEARNING: The transfer experiments target a privacy budget of (ε = 2, δ = 10−5) and report best test accuracy for each budget averaged across five runs.Hyper-parameters are selected through the search specified in Table 17.

D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD

This section studies how batch size, noise calibration, and privacy accounting affect DP-SGD for private linear and neural models. It argues and empirically finds that linear learning-rate scaling makes batch size have little influence on convergence, while DP-SGD generally needs less noise than PAI in the tested regime.

  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: With learning rate scaled linearly with batch size and a fixed epoch count for a target privacy budget, batch size has minimal influence on DP-SGD performance.The paper presents this as both a formal argument and an empirical result.
  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: For fixed (ε, δ) and T epochs, the required DP-SGD noise scale follows σ(B/N) ≈ c · √(B/N), for c ≥ 0.The relation is empirically established because no closed-form expression for σ is known.
  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: A single DP-SGD step with batch size kB, learning rate kη, and adjusted noise has total noise comparable to k smaller-batch steps.The analysis uses clipping norm C = 1 and assumes averaged clipped gradients remain approximately unchanged across the k steps.
  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: CNN training curves are near identical across a variety of batch sizes under the tested privacy schedule and linear learning-rate scaling.Figure 7 compares convergence at T = 40 or T = 60 epochs with targeted (ε = 3, δ = 10−5).
  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: Maximum achievable test accuracy remains stable when fixing one hyper-parameter, except for overly large batches or overly low learning rates in end-to-end CNNs.Figure 8 reports median and maximum performance across the remaining hyper-parameters.
  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: The PAI analysis relies on intermediate model updates being hidden from the adversary, whereas DP-SGD provides privacy for every gradient update step.This assumption underlies PAI’s alternative privacy analysis for convex optimization.
  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: DP-SGD requires less noise than PAI for the tested privacy budgets, except when ε > 40 or ε < 0.2.At very small privacy budgets, both methods require excessively large noise; the pattern is qualitatively similar across sampling rates.
  • D.1 ON THE EFFECT OF BATCH SIZES IN DP-SGD: The PAI comparison evaluates linear ScatterNet classifiers across clipping thresholds, batch sizes, and learning rates for privacy budgets 1 ≤ ε ≤ 3.PAI clips data rather than gradients, and its hyper-parameters are compared with DP-SGD.
Loading 2011.11660v3…