Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Unlocking High-Accuracy Differentially Private Image Classification through Scale

Soham De, Leonard Berrada, Jamie Hayes, Samuel L. Smith, Borja Balle

TL;DR

This work revisits differential privacy for image classification and demonstrates that DP-SGD can achieve high accuracy when paired with over-parameterized models and careful hyper-parameter management. By combining simple, effective techniques (group normalization, weight standardization, large batches, augmentation multiplicity, and parameter averaging) with strategic use of pre-training and private fine-tuning, the authors reach state-of-the-art private performance on CIFAR-10 and strong results on ImageNet, significantly narrowing the private/non-private gap. The study also investigates the intricate interplay between noise, batch size, compute budget, and learning rate, offering practical guidance on achieving optimal privacy-utility trade-offs under DP constraints. Overall, the paper provides a scalable, reproducible path toward practical high-accuracy differentially private image classification, including extensive experiments across CIFAR-10, CIFAR-100, Places-365, and ImageNet with various privacy budgets.

Abstract

Differential Privacy (DP) provides a formal privacy guarantee preventing adversaries with access to a machine learning model from extracting information about individual training points. Differentially Private Stochastic Gradient Descent (DP-SGD), the most popular DP training method for deep learning, realizes this protection by injecting noise during training. However previous works have found that DP-SGD often leads to a significant degradation in performance on standard image classification benchmarks. Furthermore, some authors have postulated that DP-SGD inherently performs poorly on large models, since the norm of the noise required to preserve privacy is proportional to the model dimension. In contrast, we demonstrate that DP-SGD on over-parameterized models can perform significantly better than previously thought. Combining careful hyper-parameter tuning with simple techniques to ensure signal propagation and improve the convergence rate, we obtain a new SOTA without extra data on CIFAR-10 of 81.4% under (8, 10^{-5})-DP using a 40-layer Wide-ResNet, improving over the previous SOTA of 71.7%. When fine-tuning a pre-trained NFNet-F3, we achieve a remarkable 83.8% top-1 accuracy on ImageNet under (0.5, 8*10^{-7})-DP. Additionally, we also achieve 86.7% top-1 accuracy under (8, 8 \cdot 10^{-7})-DP, which is just 4.3% below the current non-private SOTA for this task. We believe our results are a significant step towards closing the accuracy gap between private and non-private image classification.

Unlocking High-Accuracy Differentially Private Image Classification through Scale

TL;DR

This work revisits differential privacy for image classification and demonstrates that DP-SGD can achieve high accuracy when paired with over-parameterized models and careful hyper-parameter management. By combining simple, effective techniques (group normalization, weight standardization, large batches, augmentation multiplicity, and parameter averaging) with strategic use of pre-training and private fine-tuning, the authors reach state-of-the-art private performance on CIFAR-10 and strong results on ImageNet, significantly narrowing the private/non-private gap. The study also investigates the intricate interplay between noise, batch size, compute budget, and learning rate, offering practical guidance on achieving optimal privacy-utility trade-offs under DP constraints. Overall, the paper provides a scalable, reproducible path toward practical high-accuracy differentially private image classification, including extensive experiments across CIFAR-10, CIFAR-100, Places-365, and ImageNet with various privacy budgets.

Abstract

Differential Privacy (DP) provides a formal privacy guarantee preventing adversaries with access to a machine learning model from extracting information about individual training points. Differentially Private Stochastic Gradient Descent (DP-SGD), the most popular DP training method for deep learning, realizes this protection by injecting noise during training. However previous works have found that DP-SGD often leads to a significant degradation in performance on standard image classification benchmarks. Furthermore, some authors have postulated that DP-SGD inherently performs poorly on large models, since the norm of the noise required to preserve privacy is proportional to the model dimension. In contrast, we demonstrate that DP-SGD on over-parameterized models can perform significantly better than previously thought. Combining careful hyper-parameter tuning with simple techniques to ensure signal propagation and improve the convergence rate, we obtain a new SOTA without extra data on CIFAR-10 of 81.4% under (8, 10^{-5})-DP using a 40-layer Wide-ResNet, improving over the previous SOTA of 71.7%. When fine-tuning a pre-trained NFNet-F3, we achieve a remarkable 83.8% top-1 accuracy on ImageNet under (0.5, 8*10^{-7})-DP. Additionally, we also achieve 86.7% top-1 accuracy under (8, 8 \cdot 10^{-7})-DP, which is just 4.3% below the current non-private SOTA for this task. We believe our results are a significant step towards closing the accuracy gap between private and non-private image classification.
Paper Structure (66 sections, 1 theorem, 9 equations, 11 figures, 23 tables, 1 algorithm)

This paper contains 66 sections, 1 theorem, 9 equations, 11 figures, 23 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Paper outline.
  3. Reproducibility.
  4. Background
  5. Differential Privacy (DP)
  6. Differentially Private Stochastic Gradient Descent (DP-SGD)
  7. Privacy accounting.
  8. Challenges of DP-SGD
  9. Hyper-parameter tuning and regularization.
  10. Bias and variance of the DP-SGD update.
  11. Making standard models work.
  12. Improving the Privacy-Utility Trade-off of DP-SGD in Image Classification
  13. Training on CIFAR-10 Without Additional Data -- An Ablation Study
  14. Baseline model and private training pipeline for CIFAR-10.
  15. Training deep networks without batch normalization.
  16. ...and 51 more sections

Key Result

Lemma A.1

Each device participating in alg:dpsgd-jaxline obtains the same noisy gradient given by where $\xi \sim \mathcal{N}(0, I)$.

Figures (11)

  • Figure 1: (a) When training on CIFAR-10 without additional data, we improve on previously published results under $(\varepsilon, 10^{-5})$-DP whenever $\varepsilon \geq 3$. At $\varepsilon=8$, we improve on the previous SOTA of klause2022differentially by $9.7\%$. Note we report the mean and standard error across 5 independent runs. (b) When fine-tuning a pre-trained NFNet-F3 DBLP:conf/icml/BrockDSS21 on ImageNet under $(8, 8 \cdot 10^{-7})$-DP, we achieve $86.7\%$ top-1 accuracy, only $4.3\%$ below the current non-private SOTA of $91.0\%$yu2022coca. We also obtain $83.8\%$ top-1 accuracy under a much tighter $(0.5, 8\cdot 10^{-7})$-DP guarantee, which exceeds the performance of many popular non-private models (e.g., ResNet-50).
  • Figure 2: Increasing batch sizes on the WRN-16-4 model leads to improved training and validation accuracy under $(8,10^{-5})$-DP. We plot the mean and standard error across 5 independent runs.
  • Figure 3: Increasing augmentation multiplicities on WRN-16-4 leads to improved training and validation accuracy under $(8, 10^{-5})$-DP. We plot the mean/standard error across 5 independent runs.
  • Figure 4: Top-1 and top-5 accuracies of NF-ResNets on ImageNet under $(8, 8\cdot 10^{-7})$-DP, after fine-tuning either the last layer or all layers. To reduce the cost of these experiments we fix $B=1024$ and $\sigma=0.6$.
  • Figure 5: Top-1 and top-5 accuracies of NF-ResNet-200 on ImageNet for a range of privacy budgets $\varepsilon$ fine-tuning only the final layer with $B = 2^{18}$. We pre-train either on JFT-300M or on JFT-4B.
  • ...and 6 more figures

Theorems & Definitions (3)

  • Definition 2.1: Differential Privacy dwork2006calibrating
  • Lemma A.1
  • proof