Research map / Federated learning and privacy / Differential privacy
Training Private Models That Know What They Don’t Know
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use SCTD (training-dynamics ensemble) instead of softmax response | DP-SGD ResNet-18 · CIFAR-10, eps=1 | accuracy-normalized SC score (lower is better): 0.205 (±0.001) -> 0.152 (±0.001) | Helped |
| use SCTD instead of softmax response for coverage recovery | DP-SGD ResNet-18 · GTSRB, eps=1 | coverage to match non-private accuracy: 0.13 (±0.00) -> 0.30 (±0.02) | Helped |
| use SCTD instead of softmax response for coverage recovery | DP-SGD ResNet-18 · SVHN, eps=1 | coverage to match non-private accuracy: 0.49 (±0.02) -> 0.59 (±0.02) | Helped |
| use Deep Ensembles instead of single-run softmax response under DP | DP-SGD ResNet-18 · FashionMNIST, eps=7 | coverage to match non-private accuracy: 0.83 (±0.01) -> 0.75 (±0.00) | Hurt |
| use Monte-Carlo Dropout instead of softmax response at strong privacy | DP-SGD ResNet-18 · SVHN, eps=1 | coverage to match non-private accuracy: 0.49 (±0.02) -> 0.23 (±0.03) | Hurt |
| use SelectiveNet instead of softmax response under DP | DP-SGD ResNet-18 · FashionMNIST, eps=7 | accuracy-normalized SC score (lower is better): 0.023 (±0.000) -> 0.058 (±0.001) | Hurt |
| use Self-Adaptive Training instead of softmax response | DP-SGD ResNet-18 · coverage table, eps=1 | coverage to match non-private accuracy: FashionMNIST 0.65 (±0.03) -> 0.67 (±0.02); SVHN 0.49 (±0.02) -> 0.45 (±0.02) | Mixed |
| decrease privacy budget eps from infinity to 1 | softmax response · FashionMNIST | accuracy-normalized SC score (lower is better): 0.019 (±0.000) -> 0.041 (±0.001) | Hurt |
| decrease privacy budget eps from infinity to 1 | SCTD · CIFAR-10 | accuracy-normalized SC score (lower is better): 0.009 (±0.002) -> 0.152 (±0.001) | Hurt |
| decrease eps from 7 to 1 | SCTD · CIFAR-10 | coverage to match non-private accuracy: 0.26 (±0.03) -> 0.04 (±0.04) | Hurt |
| reduce coverage by 20%-30% at eps 7 or 3 | DP models · FashionMNIST, SVHN, GTSRB | recovering non-private utility: 20%-30% coverage reduction recovers non-private utility | Helped |
| strengthen DP (eps in infinity, 7, 3, 1) on synthetic imbalanced logistic regression | softmax response · synthetic Gaussian outlier | confidence on outlier | Hurt |
Closest papers by meaning
- Certification for Differentially Private Prediction in Gradient-Based Training (ICML 2025 · similarity 0.90)
- The Limits of Differential Privacy in Online Learning (NeurIPS 2024 · similarity 0.90)
- Optimal Differentially Private Model Training with Public Data (ICML 2024 · similarity 0.90)
- Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining (ICML 2024 · similarity 0.90)
- Differentially Private Model Merging (NeurIPS 2026 · similarity 0.89)
- Auditing Private Prediction (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.