[Paper Review] Differentially Private Bayesian Neural Networks on Accuracy, Privacy and Reliability

Qiyiwen Zhang, Zhiqi Bu+2 more|arXiv (Cornell University)|Jul 18, 2021

Privacy-Preserving Technologies in Data60 references4 citations

TL;DR

This paper proposes three differentially private Bayesian neural networks (DP-BNNs)—DP-SGLD, DP-BBP, and DP-MC Dropout—that integrate uncertainty quantification with strong privacy guarantees using differential privacy. It demonstrates that DP-SGLD achieves state-of-the-art accuracy and reliable uncertainty calibration under strong privacy constraints, revealing a novel equivalence between DP-SGD and DP-SGLD and highlighting divergent hyperparameter effects between the two methods.

ABSTRACT

Bayesian neural network (BNN) allows for uncertainty quantification in prediction, offering an advantage over regular neural networks that has not been explored in the differential privacy (DP) framework. We fill this important gap by leveraging recent development in Bayesian deep learning and privacy accounting to offer a more precise analysis of the trade-off between privacy and accuracy in BNN. We propose three DP-BNNs that characterize the weight uncertainty for the same network architecture in distinct ways, namely DP-SGLD (via the noisy gradient method), DP-BBP (via changing the parameters of interest) and DP-MC Dropout (via the model architecture). Interestingly, we show a new equivalence between DP-SGD and DP-SGLD, implying that some non-Bayesian DP training naturally allows for uncertainty quantification. However, the hyperparameters such as learning rate and batch size, can have different or even opposite effects in DP-SGD and DP-SGLD. Extensive experiments are conducted to compare DP-BNNs, in terms of privacy guarantee, prediction accuracy, uncertainty quantification, calibration, computation speed, and generalizability to network architecture. As a result, we observe a new tradeoff between the privacy and the reliability. When compared to non-DP and non-Bayesian approaches, DP-SGLD is remarkably accurate under strong privacy guarantee, demonstrating the great potential of DP-BNN in real-world tasks.

Motivation & Objective

• To bridge the gap between differential privacy and Bayesian neural networks by enabling uncertainty quantification in private deep learning.
• To develop and compare three distinct DP-BNN architectures—DP-SGLD, DP-BBP, and DP-MC Dropout—each using different mechanisms to model weight uncertainty.
• To analyze the trade-off between privacy (ε, δ), prediction accuracy, and reliability (calibration and uncertainty quantification) in DP-BNNs.
• To investigate the theoretical and empirical connections between DP-SGD and DP-SGLD, revealing that DP-SGLD is a sub-class of DP-SGD with distinct hyperparameter sensitivity.
• To evaluate the scalability, computational efficiency, and robustness of DP-BNNs across classification and regression tasks under varying privacy budgets.

Proposed method

• Proposes DP-SGLD by integrating stochastic gradient Langevin dynamics with differential privacy, using noisy gradients to sample from a posterior distribution.
• Introduces DP-BBP by adapting Bayes-by-Backprop to optimize variational posterior parameters under DP constraints, enabling end-to-end differentiable uncertainty modeling.
• Develops DP-MC Dropout by applying dropout regularization within a differentially private training framework, using stochastic forward passes to estimate predictive uncertainty.
• Employs privacy accounting via μ-GDP (Gaussian differential privacy) to precisely track and compose privacy loss across training iterations.
• Uses a Gaussian prior on network weights and evaluates uncertainty via posterior predictive variance, decomposed into epistemic (model) and aleatoric (data) uncertainty.
• Applies DP-SGD as the base optimizer across all methods, with noise injected in gradients (DP-SGLD), parameters (DP-BBP), or forward passes (DP-MC Dropout).

Experimental results

Research questions

• RQ1 How do different DP-BNN architectures (DP-SGLD, DP-BBP, DP-MC Dropout) compare in terms of prediction accuracy, uncertainty quantification, and privacy guarantees?
• RQ2 What is the theoretical relationship between DP-SGD and DP-SGLD, and how do hyperparameters like learning rate and batch size differently affect their performance?
• RQ3 To what extent does differential privacy degrade uncertainty calibration and predictive reliability in Bayesian neural networks?
• RQ4 Can DP-SGD be interpreted as a Bayesian method that naturally provides uncertainty quantification, and if so, under what conditions?
• RQ5 How does the inclusion of a prior distribution affect calibration and uncertainty estimation in DP-BNNs, especially under strong privacy constraints?

Key findings

• DP-SGLD achieves significantly better prediction accuracy than DP-BBP and DP-MC Dropout under the same privacy budget (ε=4.21, δ=1/250), with a mean squared error of 0.510 on heteroscedastic regression.
• DP-SGLD maintains high-quality uncertainty quantification under DP, with minimal degradation in posterior and data uncertainty estimates, while DP-MC Dropout shows substantially increased posterior uncertainty and unstable mean predictions.
• DP-BBP and DP-MC Dropout suffer notable performance drops under DP, despite strong non-DP performance, indicating that their variational and dropout-based uncertainty mechanisms are sensitive to noise injection.
• A new theoretical equivalence is established between DP-SGD and DP-SGLD, showing that DP-SGLD is a sub-class of DP-SGD, but with distinct hyperparameter effects—e.g., larger batch size improves privacy in DP-SGLD but not in DP-SGD.
• The use of a Gaussian prior in DP-SGLD improves calibration and reduces reliability gaps, suggesting that prior information can mitigate privacy-induced calibration errors.
• DP-SGLD demonstrates superior generalizability and reliability across architectures and tasks, outperforming non-Bayesian and non-private baselines in both accuracy and uncertainty calibration under strong privacy constraints.