Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 1: Reject
review_content: To improve the privacy-utility tradeoff, this manuscript proposes a voting mechanism used in a teacher-student model, where there is an ensemble of teachers, from which the student can get gradient information for utility improvement. The main idea of the proposed approach is to add a constant C to the maximum count collected from the ensemble, and then noise is furthermore added to the new counts. I can understand that by adding the large constant C, the identity of the maximum count could be preserved with high probability, leading to a better utility on the student side. However, equivalently, this could also be understood as that the noise is not added uniformly across all the counts, but instead a relatively smaller noise is added to the maximum count. Hence it is not clear to me whether the final composition will still be differentially private?

review_title: Official Blind Review #1

final_score: rating: 1: Reject
review_content: This paper studies the teacher ensembles setting for differentially private learning. In this setting, each teacher holds part of the training set and trains a local model. The student uses unlabeled examples to query teacher model. Then the student trains a model from scratch using the examples labeled by teachers.

In order to make the labeling process differentially private, previous work uses noisy argmax mechanism. Each class of label is assigned with a count number. The student first queries the same example to multiple teachers. To guarantee differential privacy, the counts are perturbed by noise before releasing. Then, because of the post-processing property of differential privacy, the argmax operator on such noisy counts are still differentially private.

This paper proposes to add a constant c to the largest count before perturbing and releasing the counts. The authors argue this would improve the accuracy of the noisy argmax operator and yield the same privacy loss as previous approach. However, adding a constant c would increase the sensitivity and therefore degenerates the privacy guarantee. The added noise cannot guarantee the privacy if all others are the same as previous work. To see this clearer, for example, if c=0, then one sample point can at most change the count by 1. If c>0, then one sample point can change the count by 1+c. Because of this, the proposed method cannot guarantee the amount of differential privacy as the paper claimed.

review_title: Official Blind Review #2

final_score: rating: 1: Reject
review_content: The paper proposes an improvement on the PATE framework for achieving near-zero privacy cost, and showed privacy analyses and experimental evaluations of the proposed method. 

The proposed method can be technically flawed. Adding a consent to the max will not guarantee privacy unless you account for the privacy cost for testing whether the distance of f(D) is larger than 2. This is because the distance of f(D) is data-dependent and revealing it violates privacy. Since the whole privacy analysis of PATE is based on the privacy guarantee of the Noisy ArgMax, the epsilon calculated here is voided.
review_title: Official Blind Review #3

Meta-review: This paper presents a differentially private mechanism, called Noisy ArgMax, for privately aggregating predictions from several teacher models. There is a consensus in the discussion that the technique of adding a large constant to the largest vote breaks differential privacy. Given this technical flaw, the paper cannot be accepted.
Decision: Reject