Differentially Private Learning Needs Better Features (or Much More Data)

1 INTRODUCTION . Machine learning ( ML ) models have been successfully applied to the analysis of sensitive user data such as medical images ( Lundervold & Lundervold , 2019 ) , text messages ( Chen et al. , 2019 ) or social media posts ( Wu et al. , 2016 ) . Training these ML models under the framework of differential privacy ( DP ) ( Dwork et al. , 2006b ; Chaudhuri et al. , 2011 ; Shokri & Shmatikov , 2015 ; Abadi et al. , 2016 ) can protect deployed classifiers against unintentional leakage of private training data ( Shokri et al. , 2017 ; Song et al. , 2017 ; Carlini et al. , 2019 ; 2020 ) . Yet , training deep neural networks with strong DP guarantees comes at a significant cost in utility ( Abadi et al. , 2016 ; Yu et al. , 2020 ; Bagdasaryan et al. , 2019 ; Feldman , 2020 ) . In fact , on many ML benchmarks the reported accuracy of private deep learning still falls short of “ shallow ” ( non-private ) techniques . For example , on CIFAR-10 , Papernot et al . ( 2020b ) train a neural network to 66.2 % accuracy for a large DP budget of ε = 7.53 , the highest accuracy we are aware of for this privacy budget . Yet , without privacy , higher accuracy is achievable with linear models and non-learned “ handcrafted ” features , e.g. , ( Coates & Ng , 2012 ; Oyallon & Mallat , 2015 ) . This leads to the central question of our work : Can differentially private learning benefit from handcrafted features ? We answer this question affirmatively by introducing simple and strong handcrafted baselines for differentially private learning , that significantly improve the privacy-utility guarantees on canonical vision benchmarks . Our contributions . We leverage the Scattering Network ( ScatterNet ) of Oyallon & Mallat ( 2015 ) — a non-learned SIFT-like feature extractor ( Lowe , 1999 ) —to train linear models that improve upon the privacy-utility guarantees of deep learning on MNIST , Fashion-MNIST and CIFAR-10 ( see Table 1 ) . For example , on CIFAR-10 we exceed the accuracy reported by Papernot et al . ( 2020b ) while simultaneously improving the provable DP-guarantee by 130× . On MNIST , we match the privacy-utility guarantees obtained with PATE ( Papernot et al. , 2018 ) without requiring access to any public data . We find that privately training deeper neural networks on handcrafted features also significantly improves over end-to-end deep learning , and even slightly exceeds the simpler linear models on CIFAR-10 . Our results show that private deep learning remains outperformed by handcrafted priors on many tasks , and thus has yet to reach its “ AlexNet moment ” ( Krizhevsky et al. , 2012 ) . We find that models with handcrafted features outperform end-to-end deep models , despite having more trainable parameters . This is counter-intuitive , as the guarantees of private learning degrade with dimensionality in the worst case ( Bassily et al. , 2014 ) .1 We explain the benefits of handcrafted features by analyzing the convergence rate of non-private gradient descent . First , we observe that with low enough learning rates , training converges similarly with or without privacy ( both for models with and without handcrafted features ) . Second , we show that handcrafted features significantly boost the convergence rate of non-private learning at low learning rates . As a result , when training with privacy , handcrafted features lead to more accurate models for a fixed privacy budget . Considering these results , we ask : what is the cost of private learning ’ s “ AlexNet moment ” ? That is , which additional resources do we need in order to outperform our private handcrafted baselines ? Following McMahan et al . ( 2018 ) , we first consider the data complexity of private end-to-end learning . On CIFAR-10 , we use an additional 500,000 labeled Tiny Images from Carmon et al . ( 2019 ) to show that about an order of magnitude more private training data is needed for end-to-end deep models to outperform our handcrafted features baselines . The high sample-complexity of private deep learning could be detrimental for tasks that can not leverage “ internet-scale ” data collection ( e.g. , most medical applications ) . We further consider private learning with access to public data from a similar domain . In this setting , handcrafted features can be replaced by features learned from public data via transfer learning ( Razavian et al. , 2014 ) . While differentially private transfer learning has been studied in prior work ( Abadi et al. , 2016 ; Papernot et al. , 2020a ) , we find that its privacy-utility guarantees have been underestimated . We revisit these results and show that with transfer learning , strong privacy comes at only a minor cost in accuracy . For example , given public unlabeled ImageNet data , we train a CIFAR-10 model to 92.7 % accuracy for a DP budget of ε = 2 . Our work demonstrates that higher quality features—whether handcrafted or transferred from public data—are of paramount importance for improving the performance of private classifiers in low ( private ) data regimes . Code to reproduce our experiments is available at https : //github.com/ftramer/ Handcrafted-DP . 2 STRONG SHALLOW BASELINES FOR DIFFERENTIALLY PRIVATE LEARNING . We consider the standard central model of differential privacy ( DP ) : a trusted party trains an ML model f on a private dataset D ∈ D , and publicly releases the model . The learning algorithm A 1A number of recent works have attempted to circumvent this worst-case dimensionality dependence by leveraging the empirical observation that model gradients lie in a low-dimensional subspace ( Kairouz et al. , 2020 ; Zhou et al. , 2020b ) . satisfies ( ε , δ ) -differential privacy ( Dwork et al. , 2006a ) , if for any datasets D , D′ that differ in one record , and any set of models S : Pr [ A ( D ) ∈ S ] ≤ eε Pr [ A ( D′ ) ∈ S ] + δ. DP bounds an adversary ’ s ability to infer information about any individual training point from the model . Cryptography can split the trust in a central party across users ( Jayaraman et al. , 2018 ; Bonawitz et al. , 2017 ) . Prior work has trained private deep neural networks “ end-to-end ” ( e.g. , from image pixels ) , with large losses in utility ( Shokri & Shmatikov , 2015 ; Abadi et al. , 2016 ; Papernot et al. , 2020b ) . In contrast , we study the benefits of handcrafted features that encode priors on the learning task ’ s public domain ( e.g. , edge detectors for images ) . Although end-to-end neural networks outperform such features in the non-private setting , our thesis is that handcrafted features result in an easier learning task that is more amenable to privacy . We focus on computer vision , a canonical domain for private deep learning ( Abadi et al. , 2016 ; Yu et al. , 2019b ; Papernot et al. , 2020b ; Nasr et al. , 2020 ) ) , with a rich literature on handcrafted features ( Lowe , 1999 ; Dalal & Triggs , 2005 ; Bruna & Mallat , 2013 ) . Our approach can be extended to handcrafted features in other domains , e.g. , text or speech . 2.1 SCATTERING NETWORKS . We use the Scattering Network ( ScatterNet ) of Oyallon & Mallat ( 2015 ) , a feature extractor that encodes natural image priors ( e.g. , invariance to small rotations and translations ) using a cascade of wavelet transforms ( Bruna & Mallat , 2013 ) . As this cascade of transforms is data independent , we can obtain a differentially private classifier by privately fine-tuning a ( linear ) model on top of locally extracted features . In Appendix A , we discuss other candidate “ non-deep ” approaches that we believe to be less suitable for differentially private learning . We use the default parameters in ( Oyallon & Mallat , 2015 ) , a ScatterNet S ( x ) of depth two with wavelets rotated along eight angles . For images of size H ×W , this network extracts features of dimension ( K , H/4 , W/4 ) , with K = 81 for grayscale images , and K = 243 for RGB images . Note that the transform is thus expansive . More details on ScatterNets are in Appendix C.1 . 2.2 DIFFERENTIALLY PRIVATE SCATTERNET CLASSIFIERS . To train private classifiers , we use the DP-SGD algorithm2 of Abadi et al . ( 2016 ) ( see Appendix B ) . DP-SGD works as follows : ( 1 ) batches of expected size B are sampled at random ; 3 ( 2 ) gradients are clipped to norm C ; ( 3 ) Gaussian noise of variance σ2C2/B2 is added to the mean gradient . DP-SGD guarantees privacy for gradients , and is thus oblivious to preprocessing applied independently to each data sample , such as the ScatterNet transform . When training a supervised classifier on top of ScatterNet features with gradient descent , we find that normalizing the features is crucial to obtain strong performance . We consider two approaches : • Group Normalization ( Wu & He , 2018 ) : the channels of S ( x ) are split into G groups , and each is normalized to zero mean and unit variance . Data points are normalized independently so this step incurs no privacy cost . • Data Normalization : the channels of S ( x ) are normalized by their mean and variance across the training data . This step incurs a privacy cost as the per-channel means and variances need to be privately estimated . Table 2 shows that normalization significantly accelerates convergence of non-private linear models trained on ScatterNet features , for MNIST , Fashion-MNIST and CIFAR-10 . For CIFAR-10 , Data 2Yu et al . ( 2019a ) show that DP-SGD outperforms other algorithms for private convex optimization , e.g. , logistic regression with output or objective perturbation ( Chaudhuri et al. , 2011 ; Bassily et al. , 2014 ; Kifer et al. , 2012 ) . In Appendix D.3 , we show that DP-SGD also outperforms Privacy Amplification by Iteration ( Feldman et al. , 2018 ) in our setting . 3Existing DP-SGD implementations ( tensorflow/privacy , 2019 ; pytorch/opacus , 2020 ) and many prior works ( e.g. , ( Abadi et al. , 2016 ; Papernot et al. , 2020b ) ) heuristically split the data into random batches of size exactly B . We use the same heuristic and show in Appendix D.4 that using the correct batch sampling does not affect our results . Normalization performs significantly better than Group Normalization , so the small privacy cost of estimating channel statistics is warranted . While the maximal test accuracy of these models falls short of state-of-the-art CNNs , it exceeds all previously reported results for differentially private neural networks ( even for large privacy budgets ) . 3 EVALUATING PRIVATE SCATTERNET CLASSIFIERS . We compare differentially private ScatterNet classifiers and deep learning models on MNIST ( LeCun et al. , 2010 ) , Fashion-MNIST ( Xiao et al. , 2017 ) and CIFAR-10 ( Krizhevsky , 2009 ) . Many prior works have reported improvements over the DP-SGD procedure of Abadi et al . ( 2016 ) for these datasets . As we will show , ScatterNet classifiers outperform all prior approaches while making no algorithmic changes to DP-SGD . ScatterNet classifiers can thus serve as a strong canonical baseline for evaluating proposed improvements over DP-SGD in the future .

Summary: The paper considers ways of improving private versions of SGD in the context of image classification. The main finding is that providing "hand crafted" features can significantly improve the privacy/accuracy trade-off. In some cases, even a linear model built on top of such features (like those produced by ScatterNet), can improve over differentially private SGD. A plausible explanation for this phenomenon is that extra features can reduce the number of iterations required in SGD, resulting in better privacy and/or less noise. (It is also argued that having much more data similarly improves the trade-off, but this is unsurprising and, it seems, has been observed before by McMahan et al.)