Deep Learning with Differential Privacy
Martín Abadi Andy Chu Ian Goodfellow Google.OpenAI. Work done while at Google. H. Brendan McMahan Ilya Mironov Kunal Talwar Li Zhang
Abstract
Machine learning techniques based on neural networks are achieving remarkable results in a wide variety of domains. Often, the training of models requires large, representative datasets, which may be crowdsourced and contain sensitive information. The models should not expose private information in these datasets. Addressing this goal, we develop new algorithmic techniques for learning and a refined analysis of privacy costs within the framework of differential privacy. Our implementation and experiments demonstrate that we can train deep neural networks with non-convex objectives, under a modest privacy budget, and at a manageable cost in software complexity, training efficiency, and model quality.
中文速览
神经网络模型在训练时会"记住"部分敏感数据，攻击者可能通过查看模型参数将这些隐私信息还原出来。本文提出了一套在差分隐私（differential privacy）框架下训练深度神经网络的完整方案：核心做法是在随机梯度下降（SGD）的每一步对每条样本的梯度进行裁剪、然后加入校准过的高斯噪声，同时引入"moments accountant"来精确追踪隐私损耗的高阶矩，从而比以往方法更紧地估算出累计隐私代价。在MNIST和CIFAR-10两个标准图像分类任务上的实验表明，模型可以在个位数的隐私预算（ε<10）下完成训练，精度损失相当有限。这项工作首次在非凸目标、多层、百万级参数的深度网络上实现了有理论保证的差分隐私训练，为在移动设备等敏感场景中部署机器学习模型提供了切实可行的隐私保护基础。
原文 arXiv:1607.00133;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1607.00133v2