Differentially Private Learning Needs Better Features (or Much More Data)

1 INTRODUCTION . Machine learning ( ML ) models have been successfully applied to the analysis of sensitive user data such as medical images ( Lundervold & Lundervold , 2019 ) , text messages ( Chen et al. , 2019 ) or social media posts ( Wu et al. , 2016 ) . Training these ML models under the framework of differential privacy ( DP ) ( Dwork et al. , 2006b ; Chaudhuri et al. , 2011 ; Shokri & Shmatikov , 2015 ; Abadi et al. , 2016 ) can protect deployed classifiers against unintentional leakage of private training data ( Shokri et al. , 2017 ; Song et al. , 2017 ; Carlini et al. , 2019 ; 2020 ) . Yet , training deep neural networks with strong DP guarantees comes at a significant cost in utility ( Abadi et al. , 2016 ; Yu et al. , 2020 ; Bagdasaryan et al. , 2019 ; Feldman , 2020 ) . In fact , on many ML benchmarks the reported accuracy of private deep learning still falls short of “ shallow ” ( non-private ) techniques . For example , on CIFAR-10 , Papernot et al . ( 2020b ) train a neural network to 66.2 % accuracy for a large DP budget of ε = 7.53 , the highest accuracy we are aware of for this privacy budget . Yet , without privacy , higher accuracy is achievable with linear models and non-learned “ handcrafted ” features , e.g. , ( Coates & Ng , 2012 ; Oyallon & Mallat , 2015 ) . This leads to the central question of our work : Can differentially private learning benefit from handcrafted features ? We answer this question affirmatively by introducing simple and strong handcrafted baselines for differentially private learning , that significantly improve the privacy-utility guarantees on canonical vision benchmarks . Our contributions . We leverage the Scattering Network ( ScatterNet ) of Oyallon & Mallat ( 2015 ) — a non-learned SIFT-like feature extractor ( Lowe , 1999 ) —to train linear models that improve upon the privacy-utility guarantees of deep learning on MNIST , Fashion-MNIST and CIFAR-10 ( see Table 1 ) . For example , on CIFAR-10 we exceed the accuracy reported by Papernot et al . ( 2020b ) while simultaneously improving the provable DP-guarantee by 130× . On MNIST , we match the privacy-utility guarantees obtained with PATE ( Papernot et al. , 2018 ) without requiring access to any public data . We find that privately training deeper neural networks on handcrafted features also significantly improves over end-to-end deep learning , and even slightly exceeds the simpler linear models on CIFAR-10 . Our results show that private deep learning remains outperformed by handcrafted priors on many tasks , and thus has yet to reach its “ AlexNet moment ” ( Krizhevsky et al. , 2012 ) . We find that models with handcrafted features outperform end-to-end deep models , despite having more trainable parameters . This is counter-intuitive , as the guarantees of private learning degrade with dimensionality in the worst case ( Bassily et al. , 2014 ) .1 We explain the benefits of handcrafted features by analyzing the convergence rate of non-private gradient descent . First , we observe that with low enough learning rates , training converges similarly with or without privacy ( both for models with and without handcrafted features ) . Second , we show that handcrafted features significantly boost the convergence rate of non-private learning at low learning rates . As a result , when training with privacy , handcrafted features lead to more accurate models for a fixed privacy budget . Considering these results , we ask : what is the cost of private learning ’ s “ AlexNet moment ” ? That is , which additional resources do we need in order to outperform our private handcrafted baselines ? Following McMahan et al . ( 2018 ) , we first consider the data complexity of private end-to-end learning . On CIFAR-10 , we use an additional 500,000 labeled Tiny Images from Carmon et al . ( 2019 ) to show that about an order of magnitude more private training data is needed for end-to-end deep models to outperform our handcrafted features baselines . The high sample-complexity of private deep learning could be detrimental for tasks that can not leverage “ internet-scale ” data collection ( e.g. , most medical applications ) . We further consider private learning with access to public data from a similar domain . In this setting , handcrafted features can be replaced by features learned from public data via transfer learning ( Razavian et al. , 2014 ) . While differentially private transfer learning has been studied in prior work ( Abadi et al. , 2016 ; Papernot et al. , 2020a ) , we find that its privacy-utility guarantees have been underestimated . We revisit these results and show that with transfer learning , strong privacy comes at only a minor cost in accuracy . For example , given public unlabeled ImageNet data , we train a CIFAR-10 model to 92.7 % accuracy for a DP budget of ε = 2 . Our work demonstrates that higher quality features—whether handcrafted or transferred from public data—are of paramount importance for improving the performance of private classifiers in low ( private ) data regimes . Code to reproduce our experiments is available at https : //github.com/ftramer/ Handcrafted-DP . 2 STRONG SHALLOW BASELINES FOR DIFFERENTIALLY PRIVATE LEARNING . We consider the standard central model of differential privacy ( DP ) : a trusted party trains an ML model f on a private dataset D ∈ D , and publicly releases the model . The learning algorithm A 1A number of recent works have attempted to circumvent this worst-case dimensionality dependence by leveraging the empirical observation that model gradients lie in a low-dimensional subspace ( Kairouz et al. , 2020 ; Zhou et al. , 2020b ) . satisfies ( ε , δ ) -differential privacy ( Dwork et al. , 2006a ) , if for any datasets D , D′ that differ in one record , and any set of models S : Pr [ A ( D ) ∈ S ] ≤ eε Pr [ A ( D′ ) ∈ S ] + δ. DP bounds an adversary ’ s ability to infer information about any individual training point from the model . Cryptography can split the trust in a central party across users ( Jayaraman et al. , 2018 ; Bonawitz et al. , 2017 ) . Prior work has trained private deep neural networks “ end-to-end ” ( e.g. , from image pixels ) , with large losses in utility ( Shokri & Shmatikov , 2015 ; Abadi et al. , 2016 ; Papernot et al. , 2020b ) . In contrast , we study the benefits of handcrafted features that encode priors on the learning task ’ s public domain ( e.g. , edge detectors for images ) . Although end-to-end neural networks outperform such features in the non-private setting , our thesis is that handcrafted features result in an easier learning task that is more amenable to privacy . We focus on computer vision , a canonical domain for private deep learning ( Abadi et al. , 2016 ; Yu et al. , 2019b ; Papernot et al. , 2020b ; Nasr et al. , 2020 ) ) , with a rich literature on handcrafted features ( Lowe , 1999 ; Dalal & Triggs , 2005 ; Bruna & Mallat , 2013 ) . Our approach can be extended to handcrafted features in other domains , e.g. , text or speech . 2.1 SCATTERING NETWORKS . We use the Scattering Network ( ScatterNet ) of Oyallon & Mallat ( 2015 ) , a feature extractor that encodes natural image priors ( e.g. , invariance to small rotations and translations ) using a cascade of wavelet transforms ( Bruna & Mallat , 2013 ) . As this cascade of transforms is data independent , we can obtain a differentially private classifier by privately fine-tuning a ( linear ) model on top of locally extracted features . In Appendix A , we discuss other candidate “ non-deep ” approaches that we believe to be less suitable for differentially private learning . We use the default parameters in ( Oyallon & Mallat , 2015 ) , a ScatterNet S ( x ) of depth two with wavelets rotated along eight angles . For images of size H ×W , this network extracts features of dimension ( K , H/4 , W/4 ) , with K = 81 for grayscale images , and K = 243 for RGB images . Note that the transform is thus expansive . More details on ScatterNets are in Appendix C.1 . 2.2 DIFFERENTIALLY PRIVATE SCATTERNET CLASSIFIERS . To train private classifiers , we use the DP-SGD algorithm2 of Abadi et al . ( 2016 ) ( see Appendix B ) . DP-SGD works as follows : ( 1 ) batches of expected size B are sampled at random ; 3 ( 2 ) gradients are clipped to norm C ; ( 3 ) Gaussian noise of variance σ2C2/B2 is added to the mean gradient . DP-SGD guarantees privacy for gradients , and is thus oblivious to preprocessing applied independently to each data sample , such as the ScatterNet transform . When training a supervised classifier on top of ScatterNet features with gradient descent , we find that normalizing the features is crucial to obtain strong performance . We consider two approaches : • Group Normalization ( Wu & He , 2018 ) : the channels of S ( x ) are split into G groups , and each is normalized to zero mean and unit variance . Data points are normalized independently so this step incurs no privacy cost . • Data Normalization : the channels of S ( x ) are normalized by their mean and variance across the training data . This step incurs a privacy cost as the per-channel means and variances need to be privately estimated . Table 2 shows that normalization significantly accelerates convergence of non-private linear models trained on ScatterNet features , for MNIST , Fashion-MNIST and CIFAR-10 . For CIFAR-10 , Data 2Yu et al . ( 2019a ) show that DP-SGD outperforms other algorithms for private convex optimization , e.g. , logistic regression with output or objective perturbation ( Chaudhuri et al. , 2011 ; Bassily et al. , 2014 ; Kifer et al. , 2012 ) . In Appendix D.3 , we show that DP-SGD also outperforms Privacy Amplification by Iteration ( Feldman et al. , 2018 ) in our setting . 3Existing DP-SGD implementations ( tensorflow/privacy , 2019 ; pytorch/opacus , 2020 ) and many prior works ( e.g. , ( Abadi et al. , 2016 ; Papernot et al. , 2020b ) ) heuristically split the data into random batches of size exactly B . We use the same heuristic and show in Appendix D.4 that using the correct batch sampling does not affect our results . Normalization performs significantly better than Group Normalization , so the small privacy cost of estimating channel statistics is warranted . While the maximal test accuracy of these models falls short of state-of-the-art CNNs , it exceeds all previously reported results for differentially private neural networks ( even for large privacy budgets ) . 3 EVALUATING PRIVATE SCATTERNET CLASSIFIERS . We compare differentially private ScatterNet classifiers and deep learning models on MNIST ( LeCun et al. , 2010 ) , Fashion-MNIST ( Xiao et al. , 2017 ) and CIFAR-10 ( Krizhevsky , 2009 ) . Many prior works have reported improvements over the DP-SGD procedure of Abadi et al . ( 2016 ) for these datasets . As we will show , ScatterNet classifiers outperform all prior approaches while making no algorithmic changes to DP-SGD . ScatterNet classifiers can thus serve as a strong canonical baseline for evaluating proposed improvements over DP-SGD in the future .

Summary: The paper presents an analysis of differential privacy in machine learning, with a focus on neural networks trained via differentially private stochastic gradient descent (DPSGD). The main focus and the message in the paper is that the handcrafted features work better compared to learned features during training of NNs and having more training data results in better outcomes (i.e. a better privacy-utility trade-off).