# The Protection of Data Sharing for Privacy in Financial Vision
## 3 Methods
### Build DP Models with Different Noise  
The DP consists two parameters:  
1. \(\epsilon\): privacy loss;
2. \(\delta\): probability of violating DP mechanism.  
Let the notation be DP:(\(\epsilon\), \(\delta\)) in the Equation (5). An algorithm \(M\) is with DP:(\(\epsilon\), \(\delta\)), where \(\epsilon\geq 0\) and \(0\leq\delta\leq 1\).  
A large \(\delta\) extends the limitation of the total differential privacy [36]. \(D\) and \(D^{\prime}\) differ in only one datum for any two neighboring data sets, and \(S\) is an output of \(M\)[16].  
Privacy loss \(\epsilon\) represents the probability of algorithm \(M\) in obtaining the same output on neighboring data sets. The smaller the \(\epsilon\), the more superior the privacy protection. When \(\epsilon=0\), the probability distribution of the output of algorithm \(M\) for \(D\) and \(D^{\prime}\) is the  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Hyperparameter** & **Value** \\ \hline Learning rate & 0.0006 \\ Momentum & 0.9 \\ Batch size & 100 \\ Epoch & 100 \\ \hline \hline \end{tabular}
\end{table}
Table 1: The best baseline model hyperparameters.  
Figure 10: The GASF mechanism.  
same. The output of algorithm \(M\) cannot reflect any useful information about the data set. \(\epsilon\) also reflects the availability of data. The smaller \(\epsilon\) is, the lower the availability of data.  
\[Pr[M(D)\in S]\leq e^{\epsilon}\cdot Pr[M(D^{\prime})\in S]+\delta \tag{5}\]  
Due to the complexity of the DP:\((\epsilon,\delta)\) of \(\epsilon\), a differential privacy variant Renyi Differential Privacy (RDP) later evolved [37]. The definition of RDP is in Equation (6). When \(\alpha=\infty\), RDP:\((\alpha,\epsilon)\) and DP:\(\epsilon\) are equal. DP can convert to RDP and vice versa. If algorithm M is satisfied with RDP, then, for all \(\delta\), \(M\) is also satisfied with  
\[DP:(\epsilon-\frac{\log\delta}{\alpha-1},\delta)\]  
and  
\[D_{\alpha}(M(D)\|M(D^{\prime}))\leq\epsilon. \tag{6}\]  
In this study, we use the Differentially Private Stochastic Gradient Descent (DP-SGD) proposed by Google, which applies differential privacy to gradients. In addition to Stochastic Gradient Descent (SGD), other first-order optimization methods are also applicable, such as AdaGrad or SVRG [25].  
Google proposed the DP-SGD mechanism, adding noise to the gradient [25]. DP-SGD makes two modifications to the gradient. The first is to limit the gradient according to the L2 Norm to reduce the sensitivity of each training point. The second is to add random noise with the Gaussian mechanism to the gradient, making it more challenging to match the specific training data by comparing the gradient. The detailed process is described in Algorithm \(1\)[25].  
```
Load training data \(X=\{x_{1},x_{2},...,x_{N}\}\) Set loss function \(\mathcal{L}(\theta)=\frac{1}{N}\sum_{i=1}^{N}\mathcal{L}(\theta,x_{i})\). Set learning rate \(\eta_{I}\), noise scale \(\sigma\), group size \(L\), and gradient norm bound \(C\). Initialize \(\theta_{0}\) randomly. for\(t\) in \(T\)do  Random sample a \(L_{t}\) via sampling probability \(\frac{L}{N}\). Step 1. Compute and clip gradient for\(i\) in \(L_{t}\)do  compute \(g_{t}(x_{i})\leftarrow\
abla_{\theta_{t}}\mathcal{L}(\theta_{t},x_{i})\) \(\tilde{g}_{t}(x_{i})\gets g_{t}(x_{i})\) / \(max(1,\frac{\|g_{t}(x_{i})\|_{2}}{C})\) endfor Step 2. Add random noise \(\tilde{g}_{t}\leftarrow\frac{1}{L}(\sum_{i=1}^{L}\tilde{g}_{t}(x_{i})+ \mathcal{N}(0,\sigma^{2}C^{2}I))\) Step 3. Gradient descent \(\theta_{t+1}\leftarrow\theta_{t}-\eta_{t}\cdot\tilde{g}_{t}\) endfor Step 4. Compute privacy cost Output\(\theta_{T}\) and compute the privacy cost \((\epsilon,\delta)\) with a privacy accounting method.
```  
**Algorithm 1** Differentially Private Stochastic Gradient Descent (DP-SGD).