[Paper Review] Differentially Private Variational Dropout

Beyza Ermiş, Ali Taylan Cemgil|arXiv (Cornell University)|Nov 30, 2017

Privacy-Preserving Technologies in Data17 references3 citations

TL;DR

This paper proposes differentially private variational dropout (DPVD) that leverages the intrinsic noise in variational dropout to provide formal privacy guarantees in deep neural networks. By using concentrated differential privacy (zCDP) and privacy amplification via subsampling, the method achieves significantly improved accuracy—especially under low privacy budgets—compared to standard DP and state-of-the-art methods on MNIST and DIGITS datasets.

ABSTRACT

Deep neural networks with their large number of parameters are highly flexible learning systems. The high flexibility in such networks brings with some serious problems such as overfitting, and regularization is used to address this problem. A currently popular and effective regularization technique for controlling the overfitting is dropout. Often, large data collections required for neural networks contain sensitive information such as the medical histories of patients, and the privacy of the training data should be protected. In this paper, we modify the recently proposed variational dropout technique which provided an elegant Bayesian interpretation to dropout, and show that the intrinsic noise in the variational dropout can be exploited to obtain a degree of differential privacy. The iterative nature of training neural networks presents a challenge for privacy-preserving estimation since multiple iterations increase the amount of noise added. We overcome this by using a relaxed notion of differential privacy, called concentrated differential privacy, which provides tighter estimates on the overall privacy loss. We demonstrate the accuracy of our privacy-preserving variational dropout algorithm on benchmark datasets.

Motivation & Objective

• To address the challenge of protecting sensitive training data in deep neural networks while maintaining model accuracy.
• To formalize privacy guarantees in variational dropout by exploiting its inherent randomization as a privacy mechanism.
• To reduce cumulative privacy loss in iterative training by using concentrated differential privacy (zCDP) instead of standard differential privacy.
• To improve utility under tight privacy budgets by combining zCDP with subsampling and adaptive dropout rates.
• To empirically validate the method on benchmark datasets and demonstrate superior performance compared to existing DP methods.

Proposed method

• Extends variational dropout to allow individualized dropout rates per weight, enabling fine-grained regularization and privacy control.
• Uses the intrinsic noise from stochastic forward and backward passes in variational dropout as a source of differential privacy.
• Applies concentrated differential privacy (zCDP) to bound cumulative privacy loss over multiple training iterations more tightly than standard DP.
• Employs privacy amplification via subsampling to reduce the noise required for a given privacy budget.
• Integrates gradient clipping and noise injection in stochastic optimization to satisfy zCDP constraints.
• Uses variational inference to approximate the posterior over network weights under privacy constraints.

Experimental results

Research questions

• RQ1 Can the intrinsic noise in variational dropout be formally leveraged to achieve differential privacy in deep neural networks?
• RQ2 How does using concentrated differential privacy (zCDP) improve the privacy-accuracy trade-off compared to standard differential privacy in iterative training?
• RQ3 To what extent does variational dropout with zCDP outperform standard differentially private training and state-of-the-art methods under low privacy budgets?
• RQ4 How do model hyperparameters such as hidden unit count, learning rate, and batch size affect privacy-accuracy trade-offs in the proposed framework?
• RQ5 Can the proposed method maintain high accuracy while providing measurable privacy guarantees on real-world benchmark datasets?

Key findings

• DPVD with zCDP achieved a test accuracy of 0.9687 on MNIST at ε=10, outperforming the state-of-the-art method (0.9701) and other baselines.
• At ε=0.1, DPVD-zCDP achieved 0.9026 accuracy on MNIST and 0.9038 on DIGITS, significantly outperforming SVI-zCDP (no dropout) and Abadi et al. at low privacy budgets.
• The method demonstrated robustness to hyperparameter choices, with optimal performance at 1000 hidden units and a minibatch size of 600 on MNIST.
• Privacy cost increased with the number of epochs, but zCDP allowed better tolerance than standard DP, with optimal performance between 100–200 epochs.
• Gradient clipping threshold of 4 yielded the best accuracy, with performance degrading when thresholds exceeded this value due to excessive noise.
• Larger minibatch sizes (e.g., 600) improved performance by reducing the relative impact of noise, with optimal sampling frequency ν ≈ 0.01.