Sharp Composition Bounds for Gaussian Differential Privacy via Edgeworth Expansion
Department of Statistics（统计系）；Graduate Group in Applied Mathematics and Computational Science（应用数学与计算科学研究生组）；Department of Biostatistics, Epidemiology and Informatics（生物统计学、流行病学与信息学系）
Qinqing Zheng, Jinshuo Dong, Qi Long, Weijie J. Su
Datasets containing sensitive information are often sequentially analyzed by many algorithms. This raises a fundamental question in differential privacy regarding how the overall privacy bound degrades under composition. To address this question, we introduce a family of analytical and sharp privacy bounds under composition using the Edgeworth expansion in the framework of the recently proposed f-differential privacy. In contrast to the existing composition theorems using the central limit theorem, our new privacy bounds under composition gain improved tightness by leveraging the refined approximation accuracy of the Edgeworth expansion. Our approach is easy to implement and computationally efficient for any number of compositions. The superiority of these new bounds is confirmed by an asymptotic error analysis and an application to quantifying the overall privacy guarantees of noisy stochastic gradient descent used in training private deep neural networks.
"Concentrated differential privacy" was recently introduced by Dwork and Rothblum as a relaxation of differential privacy, which permits sharper analyses of many privacy-preserving computations. We present an alternative formulation of the concept of concentrated differential privacy in terms of the Renyi divergence between the distributions obtained by running an algorithm on neighboring inputs. With this reformulation in hand, we prove sharper quantitative results, establish lower bounds, and raise a few new questions. We also unify this approach with approximate differential privacy by givi…
We consider the problem of reinforcing federated learning with formal privacy guarantees. We propose to employ Bayesian differential privacy, a relaxation of differential privacy for similarly distributed data, to provide sharper privacy loss bounds. We adapt the Bayesian privacy accounting method to the federated setting and suggest multiple improvements for more efficient privacy budgeting at different levels. Our experiments show significant advantage over the state-of-the-art differential privacy bounds for federated learning on image classification tasks, including a medical application, …
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Renmin University of China（中国人民大学）
Pairwise learning focuses on learning tasks with pairwise loss functions, depends on pairs of training instances, and naturally fits for modeling relationships between pairs of samples. In this paper, we focus on the privacy of pairwise learning and propose a new differential privacy paradigm for pairwise learning, based on gradient perturbation. Except for the privacy guarantees, we also analyze the excess population risk and give corresponding bounds under both expectation and high probability conditions. We use the \textit{on-average stability} and the \textit{pairwise locally elastic stabi…
Federated Motor Imagery Classification for Privacy-Preserving Brain-Computer Interfaces
School of Artificial Intelligence and Automation, Huazhong University of Science and Technology（华中科技大学人工智能与自动化学院）；Shenzhen Huazhong University of Science and Technology Research Institute（华中科技大学深圳研究院）；School of Civil and Hydraulic Engineering, Huazhong University of Science and Technology（华中科技大学土木与水利工程学院）
Google Research（谷歌研究院）；Carnegie Mellon University（卡内基梅隆大学）
We introduce the multi-dimensional Skellam mechanism, a discrete differential privacy mechanism based on the difference of two independent Poisson random variables. To quantify its privacy guarantees, we analyze the privacy loss distribution via a numerical evaluation and provide a sharp bound on the Rényi divergence between two shifted Skellam distributions. While useful in both centralized and distributed privacy applications, we investigate how it can be applied in the context of federated learning with secure aggregation under communication constraints. Our theoretical findings and extensi…
We develop lower bounds for estimation under local privacy constraints---including differential privacy and its relaxations to approximate or Rényi differential privacy---by showing an equivalence between private estimation and communication-restricted estimation problems. Our results apply to arbitrarily interactive privacy mechanisms, and they also give sharp lower bounds for all levels of differential privacy protections, that is, privacy mechanisms with privacy levels $\varepsilon \in [0, \infty)$. As a particular consequence of our results, we show that the minimax mean-squared error for …
Towards the Flatter Landscape and Better Generalization in Federated Learning under Client-level Differential Privacy
Tsinghua University（清华大学）；Nanjing University of Science and Technology（南京理工大学）；JD Explore Academy（京东探索研究院）；Shenzhen Wisdom and Strategy Technology Co., Ltd.（深圳智策科技有限公司）；University of Sydney（悉尼大学）
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
Traditionally, the random noise is equally injected when training with different data instances in the field of differential privacy (DP). In this paper, we first give sharper excess risk bounds of DP stochastic gradient descent (SGD) method. Considering most of the previous methods are under convex conditions, we use Polyak-Łojasiewicz condition to relax it in this paper. Then, after observing that different training data instances affect the machine learning model to different extent, we consider the heterogeneity of training data and attempt to improve the performance of DP-SGD from a new p…
Network method of moments arXiv:1202.5101 is an important tool for nonparametric network inference. However, there has been little investigation on accurate descriptions of the sampling distributions of network moment statistics. In this paper, we present the first higher-order accurate approximation to the sampling CDF of a studentized network moment by Edgeworth expansion. In sharp contrast to classical literature on noiseless U-statistics, we show that the Edgeworth expansion of a network moment statistic as a noisy U-statistic can achieve higher-order accuracy without non-lattice or smooth…
Training large neural networks with meaningful/usable differential privacy security guarantees is a demanding challenge. In this paper, we tackle this problem by revisiting the two key operations in Differentially Private Stochastic Gradient Descent (DP-SGD): 1) iterative perturbation and 2) gradient clipping. We propose a generic optimization framework, called {\em ModelMix}, which performs random aggregation of intermediate model states. It strengthens the composite privacy analysis utilizing the entropy of the training trajectory and improves the $(ε, δ)$ DP security parameters by an order …
Perhaps the single most important use case for differential privacy is to privately answer numerical queries, which is usually achieved by adding noise to the answer vector. The central question, therefore, is to understand which noise distribution optimizes the privacy-accuracy trade-off, especially when the dimension of the answer vector is high. Accordingly, extensive literature has been dedicated to the question and the upper and lower bounds have been matched up to constant factors [BUV18, SU17]. In this paper, we take a novel approach to address this important optimality question. We fir…
Communication complexity and privacy are the two key challenges in Federated Learning where the goal is to perform a distributed learning through a large volume of devices. In this work, we introduce FedSKETCH and FedSKETCHGATE algorithms to address both challenges in Federated learning jointly, where these algorithms are intended to be used for homogeneous and heterogeneous data distribution settings respectively. The key idea is to compress the accumulation of local gradients using count sketch, therefore, the server does not have access to the gradients themselves which provides privacy. Fu…
We tackle the problem of estimating a location parameter with differential privacy guarantees and sub-Gaussian deviations. Recent work in statistics has focused on the study of estimators that achieve sub-Gaussian type deviations even for heavy tailed data. We revisit some of these estimators through the lens of differential privacy and show that a naive application of the Laplace mechanism can lead to sub-optimal results. We design two private algorithms for estimating the median that lead to estimators with sub-Gaussian type errors. Unlike most existing differentially private median estimato…
ScoreShield: Differentially Private Release of Similarity Scores
School of Engineering and Applied Sciences, Harvard University（哈佛大学工程与应用科学学院）；School of Engineering, École Polytechnique Fédérale de Lausanne (EPFL)（洛桑联邦理工学院工程学院）
When Federated Learning Meets Quantum Computing: Survey and Research Opportunities
Department of Computer Science and Engineering, BITS Pilani Dubai Campus（计算机科学与工程系，比斯帕尼迪拜校区）；Department of Computer Science, Missouri University of Science and Technology（计算机科学系，密苏里科技大学）
Princeton University（普林斯顿大学）；University of Maryland, College Park（马里兰大学帕克分校）
We consider the minimax estimation problem of a discrete distribution with support size $k$ under locally differential privacy constraints. A privatization scheme is applied to each raw sample independently, and we need to estimate the distribution of the raw samples from the privatized samples. A positive number $ε$ measures the privacy level of a privatization scheme. In our previous work (IEEE Trans. Inform. Theory, 2018), we proposed a family of new privatization schemes and the corresponding estimator. We also proved that our scheme and estimator are order optimal in the regime $e^ε \ll k…
Gaussian Certified Unlearning in High Dimensions: A Hypothesis Testing Approach
Department of Operations Research and Financial Engineering, Princeton University（普林斯顿大学运筹学与金融工程系）；Department of Statistics, The Ohio State University（俄亥俄州立大学统计学系）；Department of Statistics, Columbia University（哥伦比亚大学统计学系）；Department of Electrical and Computer Engineering and Department of Operations Research and Financial Engineering, Princeton University（普林斯顿大学电气工程系和运筹学与金融工程系）
Federated EndoViT: Pretraining Vision Transformers via Federated Learning on Endoscopic Image Collections
National Center for Tumor Diseases (NCT)（国家肿瘤中心）；Translational Surgical Oncology（转化外科肿瘤学）；Faculty of Medicine and University Hospital Carl Gustav Carus, TUD Dresden University of Technology（医学系和图林根大学技术大学卡尔·古斯塔夫·卡尔医院）；DKFZ, Faculty of Medicine and University Hospital Carl Gustav Carus, TUD Dresden University of Technology（德累斯顿大学技术大学医学系和德累斯顿癌症研究中心）；Helmholtz-Zentrum Dresden-Rossendorf (HZDR)（德累斯顿-罗斯多夫亥姆霍兹中心）；Centre for Tactile Internet with Human-in-the-Loop (CeTI), TU Dresden（具有人类在环的触觉互联网中心，德累斯顿技术大学）；Visceral, Thoracic and Vascular Surgery, Faculty of Medicine and University Hospital Carl Gustav Carus, TU Dresden（visceral、胸外科和血管外科，医学系和图林根大学技术大学卡尔·古斯塔夫·卡尔医院）；Weldon School of Biomedical Engineering, Purdue University（生物医学工程韦尔登学校，普渡大学）；Medical Oncology, NCT, University Hospital Heidelberg, Germany（医学肿瘤学，国家肿瘤中心，海德堡大学医院，德国）；Medicine I, Faculty of Medicine and University Hospital Carl Gustav Carus, TU Dresden（医学I，医学系和图林根大学技术大学卡尔·古斯塔夫·卡尔医院）
