[Paper Review] Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning

Dahua Yu, Huishuai Zhang+2 more|arXiv (Cornell University)|Feb 25, 2021

Privacy-Preserving Technologies in DataComputer Science58 references28 citations

TL;DR

GEP reduces gradient perturbation dimensionality by embedding private gradients into a non-sensitive anchor subspace and perturbing the low-dimensional embedding and residuals separately, enabling higher accuracy under DP for deep models.

ABSTRACT

The privacy leakage of the model about the training data can be bounded in the differential privacy mechanism. However, for meaningful privacy parameters, a differentially private model degrades the utility drastically when the model comprises a large number of trainable parameters. In this paper, we propose an algorithm \emph{Gradient Embedding Perturbation (GEP)} towards training differentially private deep models with decent accuracy. Specifically, in each gradient descent step, GEP first projects individual private gradient into a non-sensitive anchor subspace, producing a low-dimensional gradient embedding and a small-norm residual gradient. Then, GEP perturbs the low-dimensional embedding and the residual gradient separately according to the privacy budget. Such a decomposition permits a small perturbation variance, which greatly helps to break the dimensional barrier of private learning. With GEP, we achieve decent accuracy with reasonable computational cost and modest privacy guarantee for deep models. Especially, with privacy bound $ε=8$, we achieve $74.9\%$ test accuracy on CIFAR10 and $95.1\%$ test accuracy on SVHN, significantly improving over existing results.

Motivation & Objective

• Motivate the challenge of utility loss in DP for high-dimensional deep models under practical privacy budgets.
• Propose Gradient Embedding Perturbation (GEP) to improve utility by dimensionality reduction of gradients.
• Provide theoretical DP guarantees for GEP and analyze residual gradient behavior.
• Empirically demonstrate state-of-the-art DP learning performance on MNIST, SVHN, and CIFAR-10 compared to baselines.

Proposed method

• Construct an anchor subspace from non-sensitive auxiliary data via the power method to capture principal components of anchor gradients.
• Project private gradients into the anchor subspace to obtain low-dimensional embeddings and residual gradients.
• Perturb the gradient embedding and the residual gradient separately with Gaussian noise to achieve DP, ensuring an unbiased gradient estimator when combined.
• Provide DP analysis using Rényi DP and convert to (ε, δ)-DP; use gradient clipping to control sensitivities S1 and S2.
• Implement per-group basis to reduce computation; use two-stage noise addition to improve utility for deep models.

Experimental results

Research questions

• RQ1 How to reduce the effective noise energy in DP gradient perturbation for high-dimensional models?
• RQ2 Can a low-dimensional gradient embedding plus a residual component enable accurate private learning of deep networks?
• RQ3 What are the DP guarantees and practical bounds when using GEP across common vision datasets?
• RQ4 How does GEP compare to GP (standard DP-SGD) and PATE on benchmark datasets under similar privacy budgets?

Key findings

• GEP achieves substantial accuracy improvements over DP gradient perturbation baselines (GP) across MNIST, SVHN, and CIFAR-10 for several privacy budgets.
• On CIFAR-10 with ε=8, GEP reaches 74.9% test accuracy, significantly outperforming GP by about 18.5%.
• For SVHN, GEP attains up to 95.1% test accuracy at ε=8, outperforming GP by about 3.5 percentage points.
• For MNIST, GEP achieves up to 98.4% test accuracy at ε=8, surpassing GP by about 1.2 percentage points.
• GEP demonstrates competitive or superior performance compared to PATE on these benchmarks, particularly on more complex datasets like CIFAR-10.