TWO BIRDS, ONE STONE: ACHIEVING DIFFEREN-
Year: 2021

Abstract:
Recent studies have shown that pre-trained classifiers are increasingly powerful to improve the performance on different tasks, e.g, neural language processing, image classification. However, adversarial examples from attackers can trick pretrained classifier to misclassify. To solve this challenge, a reconstruction network is built before the public pre-trained classifiers to offer certified robustness and defend against adversarial examples through input perturbation. On the other hand, the reconstruction network requires training on the dataset, which incurs privacy leakage of training data through inference attacks. To prevent this leakage, differential privacy (DP) is applied to offer a provable privacy guarantee on training data through gradient perturbation. Most existing works employ certified robustness and DP independently and fail to exploit the fact that input perturbation designed to achieve certified robustness can achieve (partial) DP. In this paper, we propose perturbation transformation to show how the input perturbation designed for certified robustness can be transformed into gradient perturbation during training. We propose Multivariate Gaussian mechanism to analyze the privacy guarantee of this transformed gradient perturbation and precisely quantify the level of DP achieved by input perturbation. To satisfy the overall DP requirement, we add additional gradient perturbation during training and propose Mixed Multivariate Gaussian Analysis to analyze the privacy guarantee provided by the transformed gradient perturbation and additional gradient perturbation. Moreover, we prove that Mixed Multivariate Gaussian Analysis can work with moments accountant to provide a tight DP estimation. Extensive experiments on benchmark datasets show that our framework significantly outperforms state-of-the-art methods and achieves better accuracy and robustness under the same privacy guarantee.

heading: 1 INTRODUCTION
text: Deep learning with pre-trained classifiers are increasingly powerful for solving difficult machinelearning tasks in the real-world, including image classification (Krizhevsky et al., 2012; Simon et al., 2016) and natural language processing (Vaswani et al., 2017; Devlin et al., 2018). However, deep learning models with pre-trained classifiers are subject to adversarial examples attacks (Szegedy et al., 2013; Bruna et al., 2013; Goodfellow et al., 2014) which apply small perturbations on inputs to cause the model to misclassify. To solve this challenge, certified robustness (Li et al., 2018) for pre-trained classifiers is proposed by (Salman et al., 2020) as a provable defense approach, where a denoiser, e.g., autoencoder (AE) (Hinton & Zemel, 1994), is trained on the data perturbed with Gaussian noise and aims to reconstruct denoised data. Once denoiser finishes training, it takes the Gaussian perturbed data for denoising reconstruction and feeds the denoised data to the pretrained classifier. Randomized smoothing is then applied and provides certified robustness without retraining the large pre-trained model.
On the other hand, the training of denoiser requires training data that can include sensitive information, e.g., clinical records, financial records, user profiles, etc. Several works have shown that attackers can infer private information from training data through trained models (Fredrikson et al., 2015; Wang et al., 2015; Shokri et al., 2017). A popular and powerful technique to address this issue in deep learning is differential privacy (DP) (Dwork et al., 2006; Dwork, 2011; Dwork et al., 2014),
which has been adopted in a large volume of works to provide a rigorous protection from leaking private information contained in training data. Gaussian Mechanism (GM) (Dwork et al., 2014) is a basic technique to achieve DP by injecting isotropic Gaussian perturbations to a computation output. Depending on where to inject the perturbations, existing works on machine learning with DP can be mainly categorized into: input perturbation (Fukuchi et al., 2017; Kang et al., 2020a;b), output perturbation (Zhang et al., 2017), gradient perturbation (Song et al., 2013; Bassily et al., 2014; Shokri & Shmatikov, 2015; Abadi et al., 2016; 2017; Wang et al., 2017; Lee & Kifer, 2018; Yu et al., 2019), objective perturbation (Kifer et al., 2012; Zhang et al., 2012; Phan et al., 2016; 2017; Iyengar et al., 2019), and noisy labelling (Papernot et al., 2016; 2018).
Therefore, a straightforward way to prevent these two critical risks, i.e., adversarial examples and privacy leakage, is independently applying certified robustness and DP to models with pre-trained classifiers. A few works (Phan et al., 2019; 2020) follow this idea and simultaneously achieve both DP and certified robustness. However, we observe that the randomized smoothing for certified robustness requires that the input data is perturbed with Gaussian noise during training. This Gaussian perturbation brings randomization to the training process and could have been utilized to provide a certain level of DP guarantee. Independently applying certified robustness and DP fails to exploit this connection and incurs unnecessary additional randomization during training, which leads to the degradation of model utility.
Directly analyzing the DP guarantee through input perturbation methods (Fukuchi et al., 2017; Kang et al., 2020a;b) is nontrivial in deep learning, because these methods pose strict constraints on loss function, which are not satisfied by deep learning models. An alternative way is to transform the input perturbation into gradient perturbation and then analyze the DP guarantee it provides. However, existing work (Kang et al., 2020a) gives strong assumption and simply regards the transformed gradient perturbation as isotropic Gaussian perturbation, and fails to recognize that in most deep learning models, this transformed gradient perturbation follows multivariate Gaussian distribution.
In this paper, we propose a novel framework TransDenoiser (Figure 1) to simultaneously achieve certified robustness and DP for models with pre-trained classifiers. TransDenoiser has a similar architecture as (Salman et al., 2020) by adding a denoiser before pre-trained classifier. Compared with (Salman et al., 2020), TransDenoiser can provide similar level of certified robustness without retraining the pre-trained model, as well as guarantee DP for the training data. Compared with existing works that achieve both certified robustness and DP including SecureSGD (Phan et al., 2019) and StoBatch (Phan et al., 2020), TransDenoiser 1) provides a tigher guarantee of DP by utilizing all the randomization during training including input and gradient perturbations, and 2) achieves more effective certified robustness by leveraging randomized smoothing on the input instead of noisy layers in the model.
Contributions. Our key contributions are:
1. We propose a novel framework TransDenoiser that trains a denoiser through both input and gradient perturbation for achieving DP and certified robustness simultaneously on deep learning models with pre-trained classifiers. The input perturbation for achieving certified robustness is utilized to achieve partial DP and additional gradient perturbation is used as necessary for the overall DP, ensuring an enhanced privacy and utility performance.
2. We present an analytical tool that leverages Taylor expansion to transform input perturbation into gradient perturbation so that it can be quantified and composed with the explicit gradient perturbation for the DP guarantee. We propose a Multivariate Gaussian Mechanism (MGM) to analyze DP of the multivariate Gaussian perturbation and prove that MGM is a generalization of Heterogeneous Gaussian Mechanism (Phan et al., 2019).
3. Observing that the transformed gradient perturbation itself cannot satisfy the DP guarantee requirement in some scenario, we add additional perturbation following isotropic Gaussian distribution to the gradient, and propose Mixed Multivariate Gaussian Analysis (MMGA) to analyze the DP guarantee provided by transformed gradient perturbation and additional gradient perturbation. We also prove that MMGA can work with moments accountant (Abadi et al., 2016) to provide a tight bound on the privacy cost.
4. We conduct extensive experiments on several benchmark datasets which demonstrate that TransDenoiser can 1) provide a significantly tighter bound on privacy cost with same utility performance, and 2) achieve similar level of certified robustness as other state-of-the-art works.

heading: 2 TRANSDENOISER
text: In this section, we will present our proposed framework TransDenoiser, which can be applied before any pre-trained classifier to guarantee certified robustness and DP without retraining the pre-trained model. A denoiser is trained to guarantee certified robustness of the final model via randomized smoothing or input perturbation on the input, where the training process introduces the input perturbation for better accuracy of the randomized smoothed model. We transform the input perturbation into equivalent gradient perturbation so that it can be quantified and composed with the explicit gradient perturbation for the DP guarantee.

heading: 2.1 DENOISER AND CERTIFIED ROBUSTNESS
text: As can be seen in Figure1, TransDenoiser is a denoising AE trained on input data with Gaussian perturbation. Similar to (Salman et al., 2020), this input Gaussian perturbation is used as randomized smoothing for certified robustness. Naively applying randomized smoothing on a pre-trained classifier without the denoiser gives very loose certification bounds because the pre-trained classifier is not trained to be robust to Gaussian perturbations of their input. The denoiser serves to “remove” this Gaussian perturbation and effectively reconstruct the input data like a pre-processing step before feeding input data into the pre-trained classifier while maintaining the benefit of certified robustness. The detailed proof of randomized smoothing can be found in (Cohen et al., 2019), and we provide a brief proof in Appendix B.
Different from (Salman et al., 2020), given input data x(i) and perturbed data z(i) = x(i) + b(i) with b(i) ⇠ N (0, 2I), the objective function we use to optimize the denoiser contains the standard reconstruction MSE:
l(z(i), ✓) = kg(z(i)) x(i)k 2 2, (1)
where l is the loss function, g denotes the denoiser, and ✓ is the parameter of the denoiser. The stability objective of (Salman et al., 2020) is not included in our objective function, because it requires both x(i) and g(z(i)) to pass the pre-trained classifier h, which both incurs additional privacy cost and additional computation overhead when we calculate the transformation matrix. In this work, we assume l(z(i), ✓) is C-Lipschitz continuous, which is a mild and common assumption in existing works (Bassily et al., 2019; Feldman et al., 2020).

heading: 2.2 PERTURBATION TRANSFORMATION AND MULTIVARIATE GAUSSIAN MECHANISM
text: In this section, we will introduce perturbation transformation and Multivariate Gaussian Mechanism (MGM) to analyze the DP guarantees of the input perturbation.
Perturbation transformation. As we introduced in 2.1, input Gaussian perturbation is utilized to achieve certified robustness for TransDenoiser. Although theoretically this perturbation is only required at the testing phase, almost all existing approaches in practice demand the randomization
during training to improve the performance. Our strategy is to transform input perturbation into gradient perturbation during training and analyze the DP guarantee that input perturbation can offer. The crucial step of this transformation is the Taylor expansion of MSE loss l(z(i), ✓) at the data point x(i), which is formulated as follows,
l(z(i), ✓) = l(x(i), ✓) + (z(i) x(i)) | rx(i) l(x(i), ✓) + o(z(i) x(i)) (2)
Since the only mild constraint on l(z(i), ✓) is C-Lipschitz continuous, it is possible for the higher order terms o(z(i) x(i)) to be negative. We denote the examples with non-negative higher order terms as “non-negative cases”, and the others as “negative cases”. In the rest of this section, we use the superscript “non” and “neg” to denote samples of “non-negative cases” and “negative cases”, respectively. For “non-negative cases”, we have the following lemma:
Lemma 1. Given perturbed example znon(i) = x non (i) + b(i) with b (k) (i) ⇠ N (0, 2), and MSE loss l(znon(i) , ✓) is C-Lipschitz continuous. The gradient r✓l(z non (i) , ✓) can be reformulated as the gradient with respect to the original sample with a gradient perturbation:
r✓l(z non (i) , ✓) r✓l(x non (i) , ✓) + p(i), (3)
where p(i) is the transformed perturbation with p(i) ⇠ N (0,⌃(i)), ⌃(i) = M(i) 2, M(i) = A(i)A | (i) and A(i) = J✓rxnon(i) l(x non (i) , ✓).
The detailed proof of Lemma 1 can be found in Appendix E. With Lemma 1, we find that the righthand side is the lower bound of left-hand side, which means DP guarantee provided by transformed gradient perturbation p(i) is the lower bound of that provided by input perturbation b(i).
Multivariate Gaussian Mechanism. Since the transformed gradient perturbation p(i) in equation (3) follows a multivariate Gaussian distribution with correlated elements, which is in contrast to the independent and isotropic Gaussian noise used in standard Gaussian mechanism for DP, we introduce Multivariate Gaussian Mechanism (MGM) to analyze DP of this multivariate Gaussian perturbation. Theorem 1. Multivariate Gaussian Mechanism. Let G : Rv ! Rw be an arbitrary w-dimensional function, and G = maxD,D0 kG(D) G(D0)k2. A Multivariate Gaussian Mechanism M with the covariance ⌃ 2 Rw⇥w adds noise to each of the w elements of the output. The mechanism M is (✏, )-DP, with
✏ 2 (0, 1], Smin(M) 1 2
p 2 ln(1.25/ ) G/✏.
where Smin(M) is the minimum singular value of M and ⌃ , M 2.
The proof of this theorem is in Appendix D. With Theorem 1, multivariate Gaussian perturbation can be leveraged to preserve (✏, )-DP, and we have the following Corollary: Corollary 1. Given a multivariate Gaussian perturbation p ⇠ N (0,⌃), ⌃ = M 2, the DP guarantee of the MGM is equivalent to that of a GM with its perturbation following a Gaussian distribution N (0, Smin(M) 2), where Smin(M) is the minimum singular value of M.
Because the DP guarantee of MGM is equivalent to the GM by applying a transformed perturbation, the traditional DP analysis technique, e.g., moments accountant Abadi et al. (2016), can be leveraged to analyze the privacy cost in the training process of denoiser. We also note a special case of MGM, in which the covariance matrix of the multivariate Gaussian perturbation only contains the diagonal values, and the perturbation on each elements is independent from each other but they can have different scales. This mechanism is called Heterogeneous Gaussian Mechanism (HGM) Phan et al. (2019). We re-define HGM in Appendix F and prove that MGM is a generalization of HGM.

heading: 2.3 TRANSDENOISER TRAINING ALGORITHM
text: As introduced in Section 2.2, the DP guarantee provided by transformed gradient perturbation depends on the transformation matrix and the scale of input noise. In some scenarios, this transformed gradient perturbation itself does not fully satisfy the DP requirement, because the scale of input noise
to achieve randomized smoothing of certified robustness is relatively small. To address this, we add additional gradient perturbation directly to the gradient in each iteration of the training process.
Algorithm 1 shows the details of our proposed TransDenoiser training algorithm to achieve both certified robustness and DP. Each record is perturbed with input perturbation to achieve certified robustness (line 7). We utilize both input perturbation and gradient perturbation to achieve DP for “non-negative cases” (Line 12 - 18), and for the “negative cases”, we directly employ gradient perturbation (Line 19 - 23). For non-negative cases, we transform input perturbation at each iteration into gradient perturbation. We then add additional gradient perturbation with scale ̄ to r✓t l(zt, ✓t) at each iteration given hyper-parameters ⇠low and ⇠up. In Algorithm 1, we use the commonly used approach, mini-batch SGD, to train the denoiser, which is slightly different from our previous setting (Lemma 1) where only a single sample is fed into the model per iteration. We will show that our DP analysis works in both of these two settings.
Algorithm 1: TransDenoiser Training Algorithm Input: pre-trained classifier h, total training epoch T , perturbation scale thresholds ⇠low and ⇠up, input
perturbation scale , learning rate ⌘, training dataset Dtrain 1 t = 0; 2 load parameters of the pre-trained classifier h; 3 initialize parameters of the denoiser g; 4 while t < T do 5 get mini-batch data xt from Dtrain; 6 for each data x(i) in xt do 7 z(i) := x(i) +N (0, 2); 8 o(z(i) x(i)) := l(z(i), ✓) (l(x(i), ✓) + (z(i) x(i))|rx(i) l(x(i), ✓)); 9 end
10 “Non-negative cases” znont := {z(i)} with o(z(i) x(i)) 0; 11 “Negative cases” znegt := {z(i)} with o(z(i) x(i)) < 0; 12 if “Non-negative cases” then 13 compute the gradient r✓t l(✓t, znont ); 14 calculate the input perturbation transformation matrix Mt; 15 calculate Smin(Mt);
16 ̄ :=
8 ><
>:
⇠up, if p
TSmin(Mt) < ⇠low,p ⇠2up TSmin(Mt) 2, else if p TSmin(Mt) < ⇠up,
0, else, ;
17 add additional perturbation to the gradient r✓l(✓t, znont ) := r✓l(✓t, znont ) +N (0, ̄2); 18 end
19 else 20 compute the gradient r✓t l(✓t, z neg t ); 21 ̄ := ⇠up; 22 add perturbation to the gradient r✓l(✓t, znegt ) := r✓l(✓t, z neg t ) +N (0, ̄2);
23 end 24 r✓t l(✓t, zt) := r✓l(✓t, znont ) +r✓l(✓t, z neg t ) ; 25 update parameter for next iteration ✓t+1 := ✓t ⌘ 1B PB i=1(r✓l(✓t, z non t ) +r✓l(✓t, znegt )); 26 end 27 output ✓T and compute overall privacy cost through moments accountant.
Privacy Analysis. In order to compose the transformed gradient perturbation and the direct isotropic gradient perturbation in each iteration for DP analysis, we introduce Mixed Multivariate Gaussian Analysis below. Theorem 2. Mixed Multivariate Gaussian Analysis. Let G : Rv ! Rw be an arbitrary wdimensional function, and G = maxD,D0 kG(D) G(D0)k2. Mixed Multivariate Gaussian Analysis is the mix of a Multivariate Gaussian Mechanism M1 with the covariance ⌃(i) 2 Rw⇥w and a Gaussian Mechanism M2 with ̄ adding noise to each of the w elements of the output. This mixed mechanism is (✏, )-DP, with
✏ 2 (0, 1], q ̄2 + TSmin(M(i)) 2 ⇠up p 2 ln(1.25/ ) G/✏.
where ̄ is the isotropic gradient perturbation, T is the number of training steps, Smin(M(i)) is the minimum singular value of M(i) and ⌃(i) , M(i) 2.
Mixed Multivariate Gaussian Analysis (MMGA) can be leveraged to analyze privacy guarantee provided by transformed gradient perturbation and additional gradient perturbation. In the following of this section, we will prove Theorem 2 and show that MMGA can work with moments accountant to provide a tighter DP estimation and preserve (✏, )-DP for deep learning models with pre-trained classifiers.
Privacy Analysis for Vanilla SGD. In vanilla SGD, the algorithm randomly picks one sample at each iteration and feeds it into the model for optimization. Given the initial parameters ✓0, iteration t, the parameters are updated as: ✓t+1 = ✓t ⌘ r✓t l(✓t, znont ), where ⌘ denotes the learning rate and znont denotes one perturbed sample randomly picked at iteration t. In optimization process, the transformed perturbation pt is slightly different from the that in Equation (3).
Lemma 2. Given perturbed example znont = xnont + bt with b (k) t ⇠ N (0, 2), the number of training steps T , and C-Lipschitz continuous loss l. The gradient r✓t l(znont , ✓t) at each step of vanilla SGD can be reformulated as:
r✓t l(z non t , ✓t) = r✓t l(x non t , ✓t) + pt, (4)
where the transformed perturbation pt ⇠ N (0, TSmin(Mt) 2I), Mt = A(i)A | (i), A(i) = J✓trxnon(i) l(x non (i) , ✓t).
The detailed proof of Lemma 2 can be found in Appendix G. Theorem 2 can be proved by Lemma 2, the definition of ̄ and Theorem 1. Thus, we have the following corollary for “non-negative cases”:
Corollary 2. Given an input perturbation bt 2 Rv with b (k) t ⇠ N (0, 2), the transformation matrix At and additional gradient perturbation with scale ̄, the DP guarantee of the MMGA is equivalent to that of a GM with its perturbation following a Gaussian distribution N (0, ⇠2up).
The above analysis for “non-negative cases” leverages perturbation transformation and MMGA to analyze DP. For “negative cases”, because the perturbation transformation is no longer required and the gradient perturbation with ̄ = ⇠up is directly added to r✓l(✓t, znegt ), the MMGA is equivalent to traditional GM with perturbation following N (0, ⇠2up). Therefore, we can conclude that Corollary 2 is applicable to both “non-negative cases” and “negative cases”.
Privacy Analysis for Mini-batch SGD. The above claims for Vanilla SGD can be adapted to Minibatch SGD by setting Mt = 1B2 PB i=1 A(i)A | (i) instead of Mt = A(i)A | (i) in Vanilla SGD. The detailed proof can be found in Appendix H.
Tighter Composition via Moments accountant. While Corollary 2 is derived with simple compositions, moments accountant can be applied with MMGA to provide a tighter DP composition for Algorithm 1. Theorem 3. There exist constants c1 and c2 so that given sampling probability q = BN and the number of training steps T , for any ✏ < c1q2, Algorithm 1 is (✏, )-differential private for any > 0 if
⇠up c2 q p T log(1/ )
✏ (5)
The proof of Theorem 8 can be found in Appendix I.
Discussion. We note that although the transformation matrix A(i) requires the clean example x(i), the calculation of A(i) does not incur privacy cost for the denoiser. This is because the transformation process and the calculation of A(i) is only for analyzing the DP of the input perturbation, i.e., the clean example x(i) does not actually contribute to the gradient r✓l(znon(i) , ✓). Another potential privacy concern is about the observations that “non-negative cases” and “negative cases” use different scales of additional gradient perturbation. Even for “non-negative cases”, different data will be applied with different ̄. We claim that the different additional perturbation scales among “nonnegative cases” and “negative cases” will not incur privacy violation, because we have proven that input perturbation also provides certain level of privacy guarantee, which is analyzed in a way that we transform it into gradient perturbation. We first use perturbation transform matrix and MGM to calculate how much gradient perturbation scale can be transformed from input perturbation for
different data. Then we add additional gradient perturbation onto transformed gradient perturbation to ensure that the overall gradient perturbation scale ̄2 + TSmin(Mt) 2 ⇠2up for each data. On the one hand, the calculation of ̄ is not visible to users or attackers. On the other hand, different ̄ can ensure the overall scale ̄2 + TSmin(Mt) 2 is a consistent lower bound for all training data.

heading: 3 EXPERIMENTS
text: In this section, we will show our experiments on two benchmark datasets, MNIST and CIFAR10. These experiments are conducted to prove that 1) TransDenoiser can provide high level of certified robustness through randomized smoothing, 2) the input perturbation transformation can save a considerable amount of DP budget and thus improve the model performance.

heading: 3.1 CONFIGURATIONS
text: Baseline and ablation studies. We employ SecureSGD (Phan et al., 2019) and StoBatch (Phan et al., 2020) two architectures in baseline approaches, and compare the certified robustness and DP performance on MNIST and CIFAR-10 datasets. We acquire two versions of SecureSGD through different training strategies: SecureSGD sct is acquired by training an entire classifier from scratch, and SecureSGD prt is acquired by training the denoiser and fixing the pre-trained classifier. For StoBatch, we only acquire the one training from scratch, because the denoiser with pre-trainied classifier can not fit to its architecture. We also conduct two ablation studies with two variants of TransDenoiser: 1) TransDenoiser nodp which only contains input perturbation for certified robustness, without the perturbation transformation and additional gradient perturbation for DP; 2) TransDenoiser sepdp which contains input perturbation for certified robustness and separate gradient perturbation for DP, without utilizing input perturbation via perturbation transformation.
Models. Pre-trained classifiers are trained on public datasets, and we use convolutional and transposed convolutional layers to build the autoencoder based denoiser for both MNIST and CIFAR10 datasets. The details of pre-trained classifiers and denoiser can be found in Appendix M.
Adversarial examples. We use four different attack algorithms, i.e., FGSM, I-FGSM (Kurakin et al., 2016), Momentum Iterative Method (MIM) (Dong et al., 2017), and MadryEtAl (Madry et al., 2017), to craft adversarial examples. These algorithms apply l2-norm attack on the pre-trained classifier under a white-box setting. Given a threshold Latk of perturbation norm, adversarial example x0 can be represented as x0 = x+ s.t. 8 2 Rv, k k2  Latk.
Certification. We employ the randomized smoothing of Cohen et al. (Cohen et al., 2019) in our work. A function robustRadius(x(i), ) is designed to return a certified radius  given the input and its perturbation scale. This indicates that the randomized smoothed model is certified robust around x(i) within the radius .
Evaluation metrics. We evaluate the performance in terms of certified accuracy (CertAcc) on clean examples and conventional accuracy (ConvAcc) on both clean and adversarial examples. CertAcc = 1N isCorrect(x(i))(robustRadius(x(i), ) R), ConvAcc = isCorrect(x0(i))
N for adversarial example; isCorrect(x(i))
N for clean example, where N denotes the test data size, x0(i) denotes the adversarial example, isCorrect(x(i)) denotes the function returning 1 when the prediction on x(i) is correct and 0 otherwise, isCorrect(x0(i)) works the same on x 0 (i), robustRadius(x(i), ) R returns 1 when the certified radius  is equal or larger than the threshold R and 0 otherwise.
Implementation details. The detailed implementation and code can be found in Appendix M.

heading: 3.2 EXPERIMENTAL RESULTS
text: We conduct our experiments on MNIST and CIFAR-10 to show that TransDenoiser can simultaneously achieve both differential privacy and certified robustness via input and gradient perturbation.
For the following experiments, we will compare with 1) SecureSGD sct, SecureSGD prt and StoBatch to show that TransDenoiser achieves better performance than baselines on certified robustness
and DP, 2) compare with TransDenoiser nodp to show that TransDenoiser still achieves high level of certified robustness after adding gradient perturbation for DP, and 3) compare with TransDenoiser sepdp to show that input perturbation transformation effectively saves a considerable amount of DP budget and improves the utility performance.
Certified robustness. We demonstrate that TransDenoiser can achieve high level of certified robustness on both MNIST and CIFAR10. We conduct experiments to measure the CertAcc on clean examples with different l2 radii of different methods on the two datasets, shown in Figure 2a and Figure 2c. TransDenoiser significantly outperforms the state-of-the-art SecureSGD prt, SecureSGD sct and StoBatch algorithms on both datasets, thanks to the benefit of perturbation transformation and randomized smoothing.
Figure 2b and Figure 2d show the comparison with ablation cases. Besides TransDenoiser nodp and TransDenoiser sepdp that we already introduced in Sec 3.1, we add one more ablation case TransDenoiser inp 0.1 denoting that the input perturbation scale for this TransDenoiser is 0.1 rather than 0.25. Comparing these ablation cases, TransDenoiser achieves similar CertAcc as TransDenoiser nodp, which means that TransDenoiser needs to add very little additional perturbation for ensuring DP thanks to the benefit of input perturbation that is being exploited. Compared with TransDenoiser sepdp that uses separate gradient perturbation for DP, TransDenoiser saves significant DP budget and thus requires less perturbation for DP, leading to significantly higher accuracy. Comparing with TransDenoiser inp 0.1, we find that TransDenoiser inp 0.1 can achieve highest CertAcc when l2 radius is small, but it drops quickly as radius increases. This is because 1) smaller input perturbation scale will bring less randomization to the model, and thus improves performance; 2) smaller input perturbation scale can only defend against less “powerful” adversarial attacks, and thus CertAcc drops when attack radius increases. Comparing the two datasets, they show similar trend besides the fact that MNIST has higher accuracy for all methods in general due to its simplicity.
Empirical defense. Certified robustness shows the theoretical defense against adversarial examples, we also conduct experiments to show that TransDenoiser can empirically defend against adversarial examples from different attacks. We only show the results against FGSM, I-FGSM attacks here, the more detailed experiments can be found in Appendix M. Figure 7a and Figure 7c show the convAcc of TransDenoiser and baselines with respect to varying attack norm bound for different attack methods on two datasets, respectively. Compared with these baselines, TransDenoiser achieves better empirical performance with any attack norm bound of all attacks. Figure 7b and Figure 7d show the comparison of TransDenoiser and ablation cases. Compared with TransDenoiser nodp, TransDenoiser achieves similar ConvAcc, which proves that perturbation for DP in TransDenoiser does not affect the ConvAcc too much. Compared with TransDenoiser sepdp, TransDenoiser effectively saves DP budget and achieves better empirical performance against adversarial examples. In all these figures, we add a curve named “Clean examples” to represent ConvAcc that clean examples pass through TransDenoiser. As can be seen, ConvAcc for clean examples keep consistent as attack norm bound increasing, and TransDenoisercan achieve similar ConAcc as “Clean examples” when attack norm bound is small.
Observing the similar results between CertAcc and ConvAcc, we see that the certified accuracy on clean examples provides a good estimation for the empirical robustness of the model. If a model achieves relatively high CertAcc on clean examples, it can have a high probability to achieve high ConvAcc on adversarial examples.
Differential privacy. We also evaluate the tradeoff between accuracy and privacy for different methods. As can be seen from Figure 4a and Figure 4b, given the same ✏, TransDenoiser can always achieve higher ConvAcc on different attacks similar to what we have observed so far. In addition, with increasing epsilon, all methods achive a higher accuracy as expected. On MNIST dataset, TransDenoiser sepdp achieves similar result with TransDenoiser.

heading: 4 CONCLUSIONS AND FUTURE WORK
text: In this paper, we have proposed TransDenoiser to achieve both DP and certified robustness via input perturbation. TransDenoiser stands as the first attempt to achieve both for the vastly existing, yet under-studied, pre-trained model setting. We leverage input perturbation transformation to efficiently transform input perturbation into gradient perturbation. We propose MGM and MMGA to analyze DP of the transformed gradient perturbation and combine MMGA with moments accountant to provide a tight bound on DP guarantee. Therefore, TransDenoiser effectively saves a considerable DP budget and improves the utility performance compared to using gradient perturbation independently to achieve DP. Our experiments on two benchmark datasets verify the performance advantage of TransDenoiser w.r.t. both DP and certified robustness compared to state-of-the-art methods. In future work, we plan to utilize more advanced DP analysis approach, e.g., analytical moments accountant (Balle & Wang, 2018), to derive a tighter bound on DP and further improve the privacy and utility tradeoff.

Review summaries:
The paper studies differential privacy for pre-trained certifiers that offer certified robustness through input perturbation. The key insight is to analyze differential privacy afforded by the input perturbation by noise transformation (computing corresponding gradient noise), and augmenting with gradient perturbation when needed for differential privacy guarantees. This improves upon past work by reducing the differential privacy budget needed by showing that some differential privacy is obtained from the input perturbation. In addition to new analysis techniques for providing the privacy bounds, experiments show gains over prior methods, e.g. better differential privacy under adversarial attack.     

This paper focuses on providing both differential privacy and certified adversarial robustness to machine learning models.  The authors propose an algorithm called TransDenoiser to achieve such a goal. TransDenoiser consists a denoiser through both input and gradient perturbation for achieving DP and certified robustness, and following by a pre-trained classifier for classification. The privacy guarantee is carefully analyzed. Extensive experiments demonstrate the effectiveness of proposed method from model utility and adversarial robustness.

In this paper, authors studied the problem of achieving both the overall differential privacy and certified robustness simultaneously for pre-trained models. They proposed a framework called TransDenoiser based on an existing framework (Salman et al, 2020) [1] by adding additional and transformed gradient perturbations for the overall DP. Authors analyzed DP guarantee provided by these perturbations and empirically evaluate their methods on MNIST and CIFAR-10, and shown that TransDenoiser is effective against FGSM and PGD attacks with guaranteed DP. 

This paper studies the problem of integrating differential privacy and robustness to adversarial examples for pre-trained machine learning models. Specifically, this work aims at designing methods that guarantee both privacy and robustness without having to re-train the model at hand. To achieve this goal, the authors build upon an existing technique in the adversarial example literature that involves placing a denoising auto-encoder in front of a pre-trained model before applying a noise injection scheme known as "randomized smoothing" [1]. While this technique is known to provide state-of-the-art "certified accuracy" against adversarial examples, its privacy guarantees remained to be studied. This work proposes to do just that by adapting the algorithm to guarantee differential privacy for the dataset used to train the auto-encoder. The authors claim three main contributions:   1. Exploiting the intrinsic train-time input perturbation that existed in the previous implementation of the algorithm and composing it with an explicit gradient perturbation to satisfy differential privacy. The authors claim that their treatment of this input perturbation allows a finer analysis of the algorithm's privacy, which ultimately leads to better accuracy, for the same privacy guarantees. 2. Introducing two new analytical tools, namely MGM and MMGA,  for analyzing the privacy guarantees of multivariate Gaussian noise injection.  3. Conducting extensive experiments on several benchmark datasets to demonstrate that their algorithm, called « TransDenoiser »,  provides better privacy guarantees and achieves similar level of certified robustness compared to previous works.   [1] Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers Hadi Salman, Greg Yang, Jerry Li, Pengchuan Zhang, Huan Zhang, Ilya Razenshteyn, Sebastien Bubeck