Machine learning models trained with differentially-private (DP) algorithms such as DP-SGD enjoy resilience against a wide range of privacy attacks. Although it is possible to derive bounds for some attacks based solely on an $(\varepsilon,δ)$-DP guarantee, meaningful bounds require a small enough privacy budget (i.e., injecting a large amount of noise), which results in a large loss in utility. This paper presents a new approach to evaluate the privacy of machine learning models against specific record-level threats, such as membership and attribute inference, without the indirection through DP. We focus on the popular DP-SGD algorithm, and derive simple closed-form bounds. Our proofs model DP-SGD as an information theoretic channel whose inputs are the secrets that an attacker wants to infer (e.g., membership of a data record) and whose outputs are the intermediate model parameters produced by iterative optimization. We obtain bounds for membership inference that match state-of-the-art techniques, whilst being orders of magnitude faster to compute. Additionally, we present a novel data-dependent bound against attribute inference. Our results provide a direct, interpretable, and practical way to evaluate the privacy of trained models against specific inference threats without sacrificing utility.
Truncated Non-Uniform Quantization for Distributed SGD
City University of Hong Kong（香港城市大学）；The Hang Seng University of Hong Kong（香港恒生大学）；University of Hawaii at Manoa（马诺阿夏威夷大学）；Sun Yat-sen University（中山大学）
Google DeepMind Gatsby Unit, University College London（谷歌深Mind加布兹单位，伦敦大学学院）；Tübingen AI Center, University of Tübingen（图宾根人工智能中心，图宾根大学）；University College London（伦敦大学学院）
Topology-aware Generalization of Decentralized SGD
College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；Shanghai Institute for Advanced Study of Zhejiang University（浙江大学上海高等研究院）；JD Explore Academy, JD.com Inc.（京东探索研究院（京东））；School of Computer Science and Technology, University of Science and Technology of China（中国科学技术大学计算机科学与技术学院）；Institute of Artificial Intelligence, Hefei Comprehensive National Science Center（合肥综合性国家科学中心人工智能研究院）；School of Computer Science, Wuhan University（武汉大学计算机学院）；Zhejiang University City College（浙江大学城市学院）
Proactive DP: A Multple Target Optimization Framework for DP-SGD
CWI Amsterdam（阿姆斯特丹数学与计算机科学中心）；Vrije Universiteit Amsterdam（阿姆斯特丹自由大学）；University of Connecticut（康涅狄格大学）；University of Science, Ho Chi Minh（胡志明市科学大学）；Vietnam National University, Ho Chi Minh city（胡志明市越南国家大学）；eBay（eBay公司）；IBM Research（IBM研究院）；Thomas J. Watson Research Center（托马斯·J·沃森研究中心）
Mohamed bin Zayed University of Artificial Intelligence（莫萨德·本·泽德人工智能大学）；University at Buffalo（布法罗大学）；King Abdullah University of Science and Technology（卡布斯国王科学与技术大学）
Improving Clinical Dataset Condensation with Mode Connectivity-based Trajectory Surrogates
Institute of Biomedical Engineering, University of Oxford, UK（生物医学工程研究所，牛津大学，英国）；GlaxoSmithKline, London, UK（葛兰素史克，伦敦，英国）；Nuffield Department of Primary Care Health Sciences, University of Oxford, UK（初级保健健康科学尼弗尔部门，牛津大学，英国）；Oxford-Suzhou Institute of Advanced Research (OSCAR), Suzhou, China（牛津-苏州先进研究所（OSCAR），苏州，中国）
Large Deviation Upper Bounds and Improved MSE Rates of Nonlinear SGD: Heavy-tailed Noise and Power of Symmetry
Carnegie Mellon University（卡内基梅隆大学）；Faculty of Technical Sciences, University of Novi Sad（诺维萨德大学技术科学学院）；Faculty of Sciences, University of Novi Sad（诺维萨德大学理学院）
SecureDrive-FL: Joint Differential Privacy and Gradient-Aware Selective Homomorphic Encryption for Federated Driver Monitoring
Institute of Industrial Automation and Software Engineering, University of Stuttgart（斯图加特大学工业自动化与软件工程研究所）；Eindhoven University of Technology (TU/e)（埃因霍温理工大学）
Optimal Rates in Continual Linear Regression via Increasing Regularization
Department of Computer Science, Technion（技术学院计算机科学系）；Blavatnik School of Computer Science and AI, Tel Aviv University（特拉维夫大学Blavatnik计算机科学与人工智能学院）；Department of Electrical and Computer Engineering, Technion（技术学院电气与计算机工程系）
