arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2007.14191stat.MLcs.CRcs.LG
收藏

用于具有差分隐私的深度学习的Tempered Sigmoid激活

Tempered Sigmoid Activations for Deep Learning with Differential Privacy

Google Brain(谷歌大脑);Apple(苹果公司)

Nicolas Papernot, Abhradeep Thakurta, Shuang Song, Steve Chien, Úlfar Erlingsson

摘要:

由于学习有时涉及敏感数据,因此机器学习算法已被扩展为为训练数据提供隐私。在实践中,这主要是事后的想法,通过使用不同的优化器重新运行训练来获得隐私保护模型,但使用在非隐私保护设置中已经表现良好的模型架构。这种方法导致了不太理想的隐私/效用权衡,正如我们在这里所展示的。相反,我们建议从头开始明确选择模型架构进行隐私保护训练。为了在差分隐私的黄金标准下提供保证,必须尽可能严格地限制单个训练点如何影响模型更新。在本文中,我们首次观察到激活函数的选择对于限制隐私保护深度学习的敏感性至关重要。我们通过分析和实验证明了一个一般的有界激活函数家族,即回火S形函数,如何始终优于ReLU等无界激活函数。使用这种范式,我们在MNIST、FashionMNIST和CIFAR 10上实现了新的最先进的准确性,而无需对学习过程基础或差分隐私分析进行任何修改。

英文摘要:

Because learning sometimes involves sensitive data, machine learning algorithms have been extended to offer privacy for training data. In practice, this has been mostly an afterthought, with privacy-preserving models obtained by re-running training with a different optimizer, but using the model architectures that already performed well in a non-privacy-preserving setting. This approach leads to less than ideal privacy/utility tradeoffs, as we show here. Instead, we propose that model architectures are chosen ab initio explicitly for privacy-preserving training. To provide guarantees under the gold standard of differential privacy, one must bound as strictly as possible how individual training points can possibly affect model updates. In this paper, we are the first to observe that the choice of activation function is central to bounding the sensitivity of privacy-preserving deep learning. We demonstrate analytically and experimentally how a general family of bounded activation functions, the tempered sigmoids, consistently outperform unbounded activation functions like ReLU. Using this paradigm, we achieve new state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10 without any modification of the learning procedure fundamentals or differential privacy analysis.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑