PaperlayerView exact revision on arXiv

Source-linked AI summary

Unlocking High-Accuracy Differentially Private Image Classification through Scale

Soham De, Leonard Berrada, Jamie Hayes, Samuel L. Smith, Borja Balle

arXiv:2204.13650v2cs.LGcs.CRcs.CVstat.ML

TL;DR

The paper addresses the performance degradation and suspected poor scaling of DP-SGD for image classification. It combines careful hyper-parameter tuning, convergence and trainability techniques, and pre-trained models, achieving high private accuracy and reducing the utility gap on academic benchmarks.

  • Problem

    DP-SGD can significantly degrade image-classification performance, while prior work has suggested that large models perform poorly because privacy noise scales with model dimension.

  • Method

    The paper combines careful hyper-parameter tuning with techniques that improve convergence and ensure trainability, and fine-tunes pre-trained over-parameterized models using DP-SGD.

  • Results

    Across CIFAR-10 and ImageNet, DP-SGD achieves substantially improved image-classification accuracy, including 83.8% top-1 accuracy on ImageNet under (0.5, 8 · 10^-7)-DP.

  • Takeaways & Limitations

    Scaling models, computational budgets, and pre-training data can significantly reduce the utility gap between private and non-private image classification on academic datasets.

  • Takeaways & Limitations

    The experiments provide record-level privacy for individual images, whereas settings where one person contributes multiple images may require user-level privacy.

Abstract

from arXiv · show

Differential Privacy (DP) provides a formal privacy guarantee preventing adversaries with access to a machine learning model from extracting information about individual training points. Differentially Private Stochastic Gradient Descent (DP-SGD), the most popular DP training method for deep learning, realizes this protection by injecting noise during training. However previous works have found that DP-SGD often leads to a significant degradation in performance on standard image classification benchmarks. Furthermore, some authors have postulated that DP-SGD inherently performs poorly on large models, since the norm of the noise required to preserve privacy is proportional to the model dimension. In contrast, we demonstrate that DP-SGD on over-parameterized models can perform significantly better than previously thought. Combining careful hyper-parameter tuning with simple techniques to ensure signal propagation and improve the convergence rate, we obtain a new SOTA without extra data on CIFAR-10 of 81.4% under (8, 10^{-5})-DP using a 40-layer Wide-ResNet, improving over the previous SOTA of 71.7%. When fine-tuning a pre-trained NFNet-F3, we achieve a remarkable 83.8% top-1 accuracy on ImageNet under (0.5, 8*10^{-7})-DP. Additionally, we also achieve 86.7% top-1 accuracy under (8, 8 \cdot 10^{-7})-DP, which is just 4.3% below the current non-private SOTA for this task. We believe our results are a significant step towards closing the accuracy gap between private and non-private image classification.

1. Introduction

Differential privacy addresses demonstrated risks of training-data extraction, but DP-SGD introduces optimization challenges and has been thought to disadvantage large models. This paper shows that careful tuning, convergence techniques, and pre-training enable strong performance with standard over-parameterized vision architectures.

  • Motivation: Differential privacy formally limits how much any single training example can influence an algorithm’s output, addressing demonstrated model-extraction risks.Adversaries have been shown to reconstruct images and recover training text from models trained on sensitive data.
  • Motivation: DP-SGD clips per-example gradients and adds Gaussian noise to privatize each mini-batch gradient.Each privatized gradient evaluation incurs privacy cost tracked by a privacy accountant.
  • Challenges: DP-SGD requires jointly tuning noise, batch size, and training iterations because noise creates a significant optimization barrier.Reducing noise also reduces the number of iterations available within a fixed privacy budget, making non-private defaults potentially sub-optimal.
  • Approach: The paper challenges the view that over-parameterized models inherently perform poorly with DP-SGD, showing that standard architectures can work well when properly tuned.The approach combines techniques that improve convergence and preserve trainability at initialization.
  • Results: 81.4% CIFAR-10 accuracy under (8, 10^-5)-DP establishes a new SOTA, improving over the previous 71.7% result under (7.5, 10^-5)-DP.The result uses Wide-ResNets trained from random initialization without extra data.
  • Results: 86.7% ImageNet top-1 accuracy under (8, 8 · 10^-7)-DP and 83.8% under (0.5, 8 · 10^-7)-DP demonstrate strong private fine-tuning results.The models use pre-training on public or non-sensitive data, with larger models and pre-training datasets yielding further improvements.
  • Results: The study identifies an optimal iteration budget, batch-size effects, and a learning-rate relationship that changes between small and large batch sizes.Larger batches improve validation accuracy but require more epochs after exceeding a threshold; learning rate scales with batch size when batches are small and becomes constant for large batches.
  • Significance: The authors frame these results as a step toward practically useful private image classification using standard vision architectures.The paper reports CIFAR and ImageNet SOTA results and emphasizes architectures commonly used for non-private training.

2. Background

Differential privacy limits how much any individual training example can influence a randomized algorithm’s output, while DP-SGD adapts stochastic gradient descent by clipping per-example gradients and adding Gaussian noise. These protections create optimization and privacy-budget trade-offs, including biased updates, constrained iterations, and noise that scales with gradient dimension.

  • Differential privacy: Differential privacy bounds the influence of any single training example on an algorithm’s output distribution.The guarantee applies to randomized algorithms and is formalized by parameters ε and δ.
  • DP-SGD: DP-SGD clips each per-example gradient, adds Gaussian noise to the clipped-gradient average, and uses privacy accounting across training updates.The noise scale is proportional to the clipping norm, while privacy depends on the noise standard deviation, sampling ratio, and number of iterations.
  • DP-SGD: DP-SGD’s privatized update masks an individual example’s contribution because clipped gradients have norm at most C and Gaussian noise is calibrated proportionally to C.The paper’s normalized implementation absorbs C into the learning rate without changing privacy guarantees.
  • Optimization challenges: DP-SGD requires jointly tuning noise, batch size, learning rate, and training iterations because reducing noise also reduces the number of updates allowed by a fixed privacy budget.Defaults from non-private training can be highly sub-optimal, and the paper does not account for the privacy cost of hyper-parameter tuning.
  • Optimization challenges: The paper reports that faster achievement of high training accuracy can improve private test accuracy, while strong regularization is usually unnecessary in its experiments.This observation motivates methods that reduce the iterations needed to reach high training accuracy.
  • Optimization challenges: Per-example clipping makes the gradient estimator biased and creates a bias–variance trade-off controlled by the clipping norm C.The estimator generally does not correspond to the gradient of a differentiable function.
  • Optimization challenges: The ℓ2 norm of DP-SGD noise scales with gradient dimension, motivating prior work on smaller models, hand-crafted features, and dimensionality reduction.This scaling led researchers to believe that standard over-parameterized models would perform poorly with DP-SGD.

3. Improving the Privacy-Utility Trade-off of DP-SGD in Image Classification

This section evaluates techniques for improving DP-SGD image classification, including architectural changes, larger batches, augmentation multiplicity, and weight standardization. These choices improve private training results on CIFAR-10 and ImageNet, while larger batches also raise the training–validation gap.

  • 3.1. Training on CIFAR-10 Without Additional Data – An Ablation Study: The ablation combines group normalization, large batch sizes, weight standardization, augmentation multiplicity, and parameter averaging to improve DP-SGD on CIFAR-10.The study uses randomly initialized models without additional data and reports validation accuracy in the ablation.
  • 3.1. Training on CIFAR-10 Without Additional Data – An Ablation Study: Increasing the batch size from 256 to 4096 significantly increases training and validation accuracy, with performance consistently improving through batch size 16384.The batch-size sweep uses WRN-16-4 under (8, 10^-5)-DP.
  • 3.1. Training on CIFAR-10 Without Additional Data – An Ablation Study: Weight standardization improves DP-SGD performance, particularly for large batches, when combined with group normalization and batch size 4096 on WRN-40-4.The reported improvement covers both training and validation accuracy.
  • 3.1. Training on CIFAR-10 Without Additional Data – An Ablation Study: Higher augmentation multiplicities improve WRN-16-4 training and validation accuracy, exceeding performance without augmentation across multiplicities from 2 to 32.The paper uses random crops and horizontal flips for CIFAR-10 augmentation multiplicity.
  • 3.2. Training on CIFAR-10 Without Additional Data – Official Evaluation: 81.4% test accuracy is achieved on CIFAR-10 under (8, 10^-5)-DP with WRN-40-4, exceeding the previous SOTA by 9.7%.The configuration uses batch size 16384 and augmentation multiplicity 32; WRN-16-4 reaches 78.7% under the same privacy guarantee.
  • 3.3. Training on ImageNet Without Additional Data: 32.4% top-1 and 55.8% top-5 accuracy are achieved on ImageNet under (8, 8 · 10^-7)-DP using NF-ResNet-50 without additional data.This improves on the cited previous top-1 result of 6.9% under (13.2, 10^-6)-DP.

4. High-Accuracy Differentially Private Image Classification with Fine-Tuning

Private fine-tuning with strong public pre-training substantially improves differentially private image classification, with larger models and pre-training datasets consistently helping. The approach reaches high accuracy on CIFAR-10, ImageNet, and Places-365, narrowing reported private–non-private gaps.

  • CIFAR-10 and CIFAR-100: 94.7% CIFAR-10 test accuracy under (1, 10^-5)-DP establishes a new fine-tuning SOTA with a pre-trained WRN-28-10.The model was pre-trained on down-sampled ImageNet and privately fine-tuned with DP-SGD.
  • CIFAR-10 and CIFAR-100: 95.6% CIFAR-10 test accuracy under (8, 10^-5)-DP is achieved by the WRN-40-4, although WRN-28-10 performs better across the evaluated privacy budgets.The stronger WRN-28-10 pre-training accuracy is offered as an explanation for this ordering.
  • ImageNet: The ImageNet fine-tuning setup removes exact and near-duplicate images from JFT-300M and JFT-4B to preserve privacy guarantees.The pre-training datasets contain 300 million and 4 billion labelled images, respectively.
  • ImageNet: 75.4% top-1 and 93.0% top-5 ImageNet accuracy are achieved by NF-ResNet-50 when privately fine-tuning only its final classifier layer.The result uses (8, 8 · 10^-7)-DP and exceeds the previous reported private fine-tuning result cited in the passage.
  • Places-365: 55.1% top-1 Places-365 accuracy under (8, 5·10^-7)-DP is only 1.9% below the authors’ 57.0% non-private baseline.For this task, training all layers outperforms training only the classifier layer.

5. The Interplay between Noise, Batch Size, Compute Budget and Learning Rate

DP-SGD performance depends on jointly tuning noise, batch size, iteration or epoch budget, and learning rate rather than transferring non-private training intuitions directly. The experiments identify distinct scaling regimes for these hyper-parameters.

  • Hyper-parameter tuning: ∼8% validation-accuracy improvement follows increasing batch size and retuning the learning rate and noise parameter.The passage contrasts this behavior with typical non-private training under a constant epoch budget.
  • Noise and iteration budget: σ_opt≈3.0 maximizes validation accuracy at fixed batch size, implying that more noise and longer training are not uniformly better.The learning rate is retuned independently for each noise choice.
  • Noise and iteration budget: T_opt≈2500 is the training-iteration budget that maximizes validation accuracy for the evaluated WRN-16-4 setting.The same optimum also appears for training accuracy.
  • Batch-size scaling: The optimal iteration budget falls rapidly at small batch sizes but is roughly constant at large batch sizes.This relationship is measured after tuning the noise parameter and learning rate.
  • Batch-size scaling: The optimal epoch budget is roughly constant for small batch sizes but proportional to batch size for large batch sizes.Large batch sizes achieve superior DP-SGD accuracy but can require more epochs.
  • Learning-rate scaling: The optimal learning rate scales linearly with batch size when batches are small and remains constant when batches are large.This scaling is observed after tuning the noise parameter.

6. Discussion

The paper’s high-accuracy private-training methodology has practical boundaries involving privacy selection, privacy unit, subgroup fairness, computational cost, and implementation correctness.

  • Privacy and fairness: Real-world deployment requires choosing privacy budgets for specific privacy–utility requirements and evaluating whether record-level rather than user-level privacy is appropriate.The experiments cover ε values below 1 through 8 and protect individual images, while users may contribute multiple images.
  • Privacy and fairness: Differentially private training may reduce accuracy on under-represented subgroups, requiring careful evaluation on imbalanced datasets.This is presented as a deployment consideration rather than a measured result of the paper’s benchmarks.
  • Computational cost: Private training requires significantly more compute than non-private training to reach optimal performance, especially with large batches or high augmentation multiplicity.The computational burden is reduced when fine-tuning only the last layer is sufficient.
  • Computational cost: Fine-tuning the whole model is typically optimal when transferring between datasets other than JFT-300M/4B to ImageNet, limiting the computational savings of last-layer fine-tuning.The paper reports last-layer fine-tuning as sufficient for high accuracy in the JFT-to-ImageNet setting.
  • Correctness: Formal DP guarantees depend on correct implementation, which can be compromised by minor algorithmic variations and human errors.The released implementation includes unit tests and underwent two independent internal technical reviews.

Conclusion

The paper shows that scaling models, computational budgets, and pre-training data can substantially reduce the utility gap in private image classification. It reports strong accuracy using standard computer-vision architectures and releases implementation resources for reproducibility and verification.

  • 83.8% top-1 accuracy is achieved on ImageNet under a (0.5, 8 · 10−7)-DP guarantee.
  • Scaling models, computational budgets, and pre-training data significantly reduces the utility gap between private and non-private image classification.
  • The reported results use standard computer-vision architectures with minimal modification, supporting reuse in existing pipelines.
  • The implementation is open sourced to support reproducibility and allow the differential privacy community to verify DP-SGD.
  • The privacy accountant assumes sampling with replacement, whereas the implementation uses random shuffling; tight accounting for shuffled Gaussian mechanisms remains open.

A.1. Implementation Details

Algorithm 1 computes privatized gradients across devices using virtual batching, multiple augmentations, clipping, synchronized Gaussian noise, and gradient normalization. The design ensures every device obtains the same averaged noisy gradient for model updates.

  • Algorithm 1 computes private gradients across devices with virtual batching, multiple augmentations, synchronized noise, and gradient normalization.
  • Each device processes local batches across accumulation steps, using shared Gaussian noise samples and a global batch-size product.
  • Per-example gradients are averaged over K augmentations, clipped to norm C, normalized, and averaged locally before noise addition.
  • Devices add the same appropriately scaled Gaussian noise, synchronize their updates, and obtain an identical averaged noisy gradient.
  • The implementation’s correctness follows by comparing its resulting noisy gradient with the DP-SGD update equation.

A.2. Privacy Lower Bounds via Membership Inference Attacks

The audit estimates empirical lower bounds on privacy loss through membership inference attacks, while noting that the test is incomplete and dataset choice affects distinguishability. The implementation uses MNIST-based experiments and reports no violations of nominal guarantees.

  • Membership inference attacks provide empirical lower bounds on privacy guarantees, but failing to find a violation cannot rule one out.
  • The hypothesis test compares models trained on neighboring datasets and uses loss distributions to estimate a valid lower bound on ε.
  • The attack first designs a learning problem maximizing membership distinguishability, then runs a membership inference procedure.
  • The experiments train large numbers of LeNet models on MNIST neighboring datasets, using confidence intervals to obtain probabilistic ε lower bounds.
  • No violation of the reported (ε, δ)-DP guarantees was found, while smaller datasets produced substantially tighter lower bounds than datasets of size 60K.
  • MNIST was selected to expose possible preprocessing errors, although it is unlikely to maximize privacy lower bounds.

B.2. The Optimal Model Depth Depends on the Privacy Budget and Training Setup

The optimal model depth varies with privacy budget, augmentation, and training setup rather than following a single rule. Large augmentation multiplicities accelerate convergence in deeper networks, while fine-tuning favors larger models consistently.

  • B.2. The Optimal Model Depth Depends on the Privacy Budget and Training Setup: Large augmentation multiplicity K=16 significantly accelerates convergence of deeper WRNs, with WRN-40-4 outperforming WRN-16-4 early at ε=8.
  • B.2. The Optimal Model Depth Depends on the Privacy Budget and Training Setup: The optimal network depth depends on the privacy budget and other training choices.
  • B.2. The Optimal Model Depth Depends on the Privacy Budget and Training Setup: At (1, 10−5)-DP, WRN-16-4 slightly outperforms WRN-40-4, whereas WRN-40-4 performs better at larger privacy budgets.
  • B.2. The Optimal Model Depth Depends on the Privacy Budget and Training Setup: Fine-tuning pre-trained networks favors larger models, which consistently outperform shallower networks even at small privacy budgets.
  • B.2. The Optimal Model Depth Depends on the Privacy Budget and Training Setup: 95.6% test accuracy is achieved when fine-tuning a WRN-40-4 pre-trained on ImageNet-32 for CIFAR-10.
  • B.2. The Optimal Model Depth Depends on the Privacy Budget and Training Setup: 89.0% test accuracy is achieved on CIFAR-10 under (8, 10−5)-DP after private fine-tuning from a WRN-40-4 pre-trained on CIFAR-100.

B.5. Optimal Noise Scale for a Fixed Batch Size: Experiments on the WRN-40-4

Experiments on WRN-40-4 provide additional evidence that, for a fixed batch size, DP-SGD has an optimal noise scale and corresponding compute budget.

  • A WRN-40-4 trained on CIFAR-10 at batch size 16384 under (8, 10^-5)-DP exhibits an optimal noise scale.The experiment uses the same setup as the earlier WRN-16-4 analysis, except for the model and batch size.
  • The optimal noise-scale property also holds at other batch sizes.

B.6. Scaling of the Compute Budget with the Batch Size: Experiments on the WRN-40-4

WRN-40-4 experiments reproduce the earlier finding that optimal training budgets and learning rates vary systematically with batch size under DP-SGD.

  • WRN-40-4 experiments under (8, 10^-5)-DP show qualitatively the same batch-size behavior as WRN-16-4.The comparison concerns optimal training iterations, epochs, and learning rates.
  • The study examines optimal compute budgets and learning rates across a range of batch sizes.
  • The CIFAR experiments use Wide-ResNet models with group normalization replacing batch normalization.The number of groups is set to 16.

C.2. Dataset Details

The paper specifies dataset preprocessing, evaluation splits, augmentation, training conventions, and hyper-parameter search procedures across CIFAR, ImageNet, ImageNet-32, and Places-365.

  • Preprocessing and training: Training-time augmentation consists of random crops and horizontal flips, with no augmentation during evaluation.
  • CIFAR: CIFAR-10 uses 45K training images for validation results and all 50K training-plus-validation images for test results.The privacy accountant uses the corresponding number of examples.
  • ImageNet: ImageNet fine-tuning uses 320 × 320 images, whereas ImageNet training from random initialization uses 224 × 224 images.
  • DP-SGD training: DP-SGD experiments use a constant learning rate without decay and omit explicit regularizers such as weight decay and label smoothing.
  • Hyper-parameter search: Learning rates are tuned on a logarithmic grid and training iterations on a linear grid, with privacy noise calculated for each combination.The search checks that optimal values do not lie on the grid boundary.

C.5. Optimal Hyper-parameter Values for the Best Results

The appendix reports the hyper-parameter configurations used for the paper’s best results across private training and transfer-learning tasks.

  • CIFAR-10: Tables 13 and 14 list hyper-parameters for CIFAR-10 training without extra data using WRN-16-4 and WRN-40-4.
  • ImageNet: Table 15 lists hyper-parameters for ImageNet training without extra data using NF-ResNet-50.
  • Transfer learning: Tables 16–19 list hyper-parameters for ImageNet-32-to-CIFAR-10 and ImageNet-32-to-CIFAR-100 fine-tuning.The configurations cover fine-tuning all layers and only the last layer of WRN-28-10.
  • Transfer learning: Table 20 lists hyper-parameters for CIFAR-100-to-CIFAR-10 fine-tuning of all WRN-40-4 layers.
  • Transfer learning: Tables 21–23 report hyper-parameters for JFT-to-ImageNet and JFT-300M-to-Places-365 fine-tuning.
Loading 2204.13650v2…