Research map / Federated learning and privacy / Differential privacy
Certification for Differentially Private Prediction in Gradient-Based Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Certifies dataset-specific prediction stability via abstract gradient training (interval bound propagation over parameters) and uses the resulting smooth-sensitivity bounds to add less noise for differentially private prediction.
Problem
Private prediction via output noise is calibrated to global sensitivity, which is loose and gives worse privacy-utility trade-offs than private training (DP-SGD).
Approach
Abstract Gradient Training bounds the set of reachable model parameters under up to k dataset additions/removals using interval bound propagation through SGD; the resulting prediction-stability certificates give dataset-specific upper bounds on smooth sensitivity, enabling tighter Cauchy noise for private prediction and for subsample-and-aggregate ensembles.
Key results
- Single-model smooth sensitivity keeps noise-free accuracy at privacy budgets up to an order of magnitude lower than global sensitivity; on Blobs, teacher accuracy is 99.8 (SS) vs 82.8 (GS) in the reported table.
- On IMDB, single-model SS achieves 73.5 vs 54.4 for GS and 70.5 for DP-SGD in the teacher-label experiment.
- Private prediction outperforms DP-SGD on OctMNIST and IMDB for fewer than 100 queries but degrades rapidly as queries increase; the highest accuracy is typically achieved by large ensembles with global sensitivity.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use smooth sensitivity instead of global sensitivity for the single-model prediction mechanism | Single-model private prediction · Blobs | accuracy: 82.8 -> 99.8 | Helped |
| Use smooth sensitivity instead of global sensitivity for the single-model prediction mechanism | Single-model private prediction · OctMNIST | accuracy: 12.7 -> 18.7 | Helped |
| Use smooth sensitivity instead of global sensitivity for the single-model prediction mechanism | Single-model private prediction · IMDB | accuracy: 54.4 -> 73.5 | Helped |
| Use smooth sensitivity instead of global sensitivity for subsample-and-aggregate | Subsample-and-aggregate private prediction · Blobs | accuracy: 99.5 -> 98.1 | Hurt |
| Use smooth sensitivity instead of global sensitivity for subsample-and-aggregate | Subsample-and-aggregate private prediction · OctMNIST | accuracy: 14.1 -> 19.8 | Helped |
| Use smooth sensitivity instead of global sensitivity for subsample-and-aggregate | Subsample-and-aggregate private prediction · IMDB | accuracy: 73.0 -> 71.7 | Hurt |
| Use smooth sensitivity bounds rather than global sensitivity in the single-model private prediction mechanism | Single-model private prediction · Blobs, OctMNIST, and IMDB | accuracy | Helped |
| Increase ensemble size in the smooth-sensitivity aggregation mechanism | Subsample-and-aggregate private prediction · Binary classification tasks | accuracy | Mixed |
Surprising findings
- Subsample-and-aggregate with smooth sensitivity does not beat global sensitivity for large ensembles, since per-member data shrinks and certified distances weaken.
- DP-SGD achieves 1.0% accuracy on Blobs in the teacher-label table, showing a collapse in that setting.
Limitations
- Bounds are loose for multi-class cross-entropy and non-separable or small datasets.
- Bound propagation assumes worst-case additions and removals at every parameter index, which may require larger batches or fewer epochs.
- Experiments are limited to binary classification with small models and datasets.
Experimental setup
Datasets: Blobs (synthetic) OctMNIST IMDB
Benchmarks: Blobs OctMNIST IMDB
Metrics: private accuracy smooth sensitivity bound tightness accuracy vs privacy budget epsilon accuracy vs inference query budget
Baselines: global sensitivity noisy prediction PATE-style noisy argmax ensemble DP-SGD
Builds on: smooth sensitivity PATE DP-SGD interval bound propagation
Closest papers by meaning
- Online Sensitivity Optimization in Differentially Private Learning (AAAI 2024 · similarity 0.90)
- Instance-Specific Asymmetric Sensitivity in Differential Privacy (NeurIPS 2024 · similarity 0.89)
- Attack-Aware Noise Calibration for Differential Privacy (NeurIPS 2024 · similarity 0.89)
- Provable Privacy with Non-Private Pre-Processing (ICML 2024 · similarity 0.89)
- Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining (ICML 2024 · similarity 0.89)
- The Limits of Differential Privacy in Online Learning (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.