[Paper Review] Differentially Private Dropout

Beyza Ermiş, Ali Taylan Cemgil|arXiv (Cornell University)|Nov 30, 2017

Privacy-Preserving Technologies in Data16 references3 citations

TL;DR

This paper introduces Differentially Private Dropout (DPD), a novel technique that leverages the inherent noise in Gaussian dropout to provide formal privacy guarantees via concentrated differential privacy (zCDP). By combining zCDP composition with privacy amplification from subsampling, DPD achieves significantly improved accuracy—especially under low privacy budgets—on MNIST and DIGITS benchmarks compared to standard DP and state-of-the-art methods.

ABSTRACT

Large data collections required for the training of neural networks often contain sensitive information such as the medical histories of patients, and the privacy of the training data must be preserved. In this paper, we introduce a dropout technique that provides an elegant Bayesian interpretation to dropout, and show that the intrinsic noise added, with the primary goal of regularization, can be exploited to obtain a degree of differential privacy. The iterative nature of training neural networks presents a challenge for privacy-preserving estimation since multiple iterations increase the amount of noise added. We overcome this by using a relaxed notion of differential privacy, called concentrated differential privacy, which provides tighter estimates on the overall privacy loss. We demonstrate the accuracy of our privacy-preserving dropout algorithm on benchmark datasets.

Motivation & Objective

• To provide a formal privacy guarantee for deep neural networks trained with dropout by exploiting its intrinsic randomization.
• To address the challenge of cumulative privacy loss in iterative training by using concentrated differential privacy (zCDP) instead of standard differential privacy.
• To improve the utility-privacy trade-off in differentially private deep learning by efficiently allocating the privacy budget across training iterations.
• To demonstrate that dropout, traditionally used for regularization, can simultaneously enhance model accuracy and provide measurable differential privacy.

Proposed method

• The method uses Gaussian dropout with individualized dropout rates per weight, enabling a Bayesian interpretation and intrinsic noise injection.
• It applies zCDP composition analysis to tightly bound the cumulative privacy loss over multiple training iterations.
• Privacy amplification via subsampling is leveraged to reduce the amount of additive noise required for the same privacy guarantee.
• The approach integrates with stochastic gradient descent (SGD) and uses gradient clipping to control sensitivity.
• The framework is compatible with standard neural network architectures and does not require architectural changes.
• The method is evaluated using the moments accountant technique, closely related to zCDP, for privacy accounting.

Experimental results

Research questions

• RQ1 Can the intrinsic noise from dropout be formally leveraged to provide differential privacy guarantees in deep neural networks?
• RQ2 How can zCDP be used to more efficiently manage privacy budget accumulation in iterative training compared to standard DP?
• RQ3 To what extent does dropout improve model accuracy while preserving privacy in low-budget settings?
• RQ4 How does the combination of subsampling and zCDP reduce noise requirements without compromising privacy?

Key findings

• DPD-zCDP achieved test accuracies of 97.18% on MNIST and 95.18% on DIGITS at ε=10, outperforming standard DP and state-of-the-art methods.
• At ε=0.5, DPD-zCDP achieved 92.05% accuracy on MNIST and 91.25% on DIGITS, significantly outperforming Abadi et al. (2016) and SGLD-zCDP.
• The method showed robustness to hyperparameter variations, with optimal performance at 1000 hidden units, 200 epochs, and a minibatch size of 600.
• Privacy budget efficiency was enhanced by zCDP, which allowed lower noise levels than standard DP while maintaining comparable privacy guarantees.
• The model remained accurate even under low privacy budgets, with DPD-zCDP showing a 2.5–3% accuracy advantage over baseline DP methods at ε=0.5.