[论文解读] Tighter Generalization Bounds for Iterative Differentially Private Learning Algorithms

Fengxiang He, Bohan Wang+1 more|arXiv (Cornell University)|Jul 18, 2020

Privacy-Preserving Technologies in Data参考文献 80被引用 6

一句话总结

本文通过新颖的组合定理，将隐私与泛化联系起来，为迭代式差分隐私学习算法建立了更紧致的泛化界。证明了 $(\varepsilon,\delta)$-差分隐私可推导出不依赖模型大小的、严格优于以往工作的高概率泛化界，并将这些结果应用于随机梯度朗之万动力学和对抗性联邦学习。

ABSTRACT

This paper studies the relationship between generalization and privacy preservation in iterative learning algorithms by two sequential steps. We first establish an alignment between generalization and privacy preservation for any learning algorithm. We prove that $(\varepsilon, δ)$-differential privacy implies an on-average generalization bound for multi-database learning algorithms which further leads to a high-probability bound for any learning algorithm. This high-probability bound also implies a PAC-learnable guarantee for differentially private learning algorithms. We then investigate how the iterative nature shared by most learning algorithms influence privacy preservation and further generalization. Three composition theorems are proposed to approximate the differential privacy of any iterative algorithm through the differential privacy of its every iteration. By integrating the above two steps, we eventually deliver generalization bounds for iterative learning algorithms, which suggest one can simultaneously enhance privacy preservation and generalization. Our results are strictly tighter than the existing works. Particularly, our generalization bounds do not rely on the model size which is prohibitively large in deep learning. This sheds light to understanding the generalizability of deep learning. These results apply to a wide spectrum of learning algorithms. In this paper, we apply them to stochastic gradient Langevin dynamics and agnostic federated learning as examples.

研究动机与目标

• 建立任意学习算法中差分隐私与泛化之间的理论联系。
• 分析学习算法的迭代性质如何影响隐私退化与泛化性能。
• 推导出不依赖模型大小的差分隐私学习的更紧致高概率泛化界。
• 提出可准确估计迭代算法累积隐私损失的组合定理。
• 展示该框架在实际算法（如随机梯度朗之万动力学和联邦学习）中的适用性。

提出的方法

• 推导出在 $(\varepsilon,\delta)$-差分隐私下，多数据库学习算法的平均泛化界。
• 通过利用平均泛化界与集中不等式，建立高概率泛化界。
• 提出三种组合定理，基于每轮的隐私预算，近似迭代算法的差分隐私。
• 将隐私-泛化联系与组合定理结合，为迭代学习提供端到端的泛化界。
• 通过噪声注入与梯度裁剪，将该框架应用于随机梯度朗之万动力学和对抗性联邦学习。
• 使用切尔诺夫不等式与矩生成函数，分析高斯机制与裁剪梯度机制的隐私性。

实验结果

研究问题

• RQ1 差分隐私在迭代学习算法中如何与泛化误差相关联？
• RQ2 能否在不依赖模型大小的前提下，为差分隐私学习推导出更紧致的高概率泛化界？
• RQ3 在迭代学习中，隐私如何随迭代次数退化？能否对其进行定量建模？
• RQ4 能否改进组合定理，以获得对迭代算法更紧致的隐私估计？
• RQ5 所提出的边界在实际算法（如SGLD和联邦学习）中，能在多大程度上提升泛化与隐私保障？

主要发现

• 高概率泛化界的项 $a$ 从 $13\varepsilon$ 紧缩至 $9\varepsilon$，优于先前的最先进水平。
• 失败概率 $b$ 的界从 $\frac{2\delta}{\varepsilon}\log\left(\frac{2}{\varepsilon}\right)$ 改进为 $\frac{2e^{-\varepsilon}\delta}{\varepsilon}\log\left(\frac{2}{\varepsilon}\right)$，显著降低了错误概率。
• 与 Nissim 和 Stemmer (2018) 相比，平均多数据库泛化界的紧致性提高了 $e^{\varepsilon}$ 倍。
• 所提出的组合定理对 $\delta$ 的近似比现有结果更紧，从而改进了迭代算法的隐私会计。
• 该框架通过所推导的高概率泛化界，保证了差分隐私学习算法的PAC可学习性。
• 所提边界与模型大小无关，因此在模型规模极为庞大的深度学习中尤为相关。