Rethinking Benchmarks for Differentially Private Image Classification

TL;DR

This work addresses the mismatch between progress on standard DP benchmarks and privacy-sensitive image domains by proposing a standardized DP image-classification benchmark suite built around CheXpert and EyePACS, with a public leaderboard and careful reporting of privacy accounting. It evaluates diverse techniques—from ScatterNets to CLIP-based models—across multiple privacy regimes, public-data conditions, and ablations, revealing that success on CIFAR-10 does not generalize to medical datasets and that pretraining benefits grow with looser privacy budgets. The contributions include a practical benchmark design, a community-accessible leaderboard with reproducibility checks, and an empirical analysis showing dataset- and architecture-dependent effects of normalization, batch size, augmentation, and parameter averaging. The results underscore the need for broad, domain-aware benchmarks to drive meaningful DP advances and highlight that progress in standard benchmarks may not translate to privacy-critical deployments. Overall, this work provides a foundation for more generalizable DP image-classification research and invites ongoing refinement of benchmarks and techniques as DP ML scales to diverse domains.

Abstract

We revisit benchmarks for differentially private image classification. We suggest a comprehensive set of benchmarks, allowing researchers to evaluate techniques for differentially private machine learning in a variety of settings, including with and without additional data, in convex settings, and on a variety of qualitatively different datasets. We further test established techniques on these benchmarks in order to see which ideas remain effective in different settings. Finally, we create a publicly available leader board for the community to track progress in differentially private machine learning.

Figures (5)

• Figure 1: EyePACS and CheXpert qualitatively look different than common benchmark datasets such as CIFAR-10 and ImageNet.
• Figure 2: Normalization generally improves the final performance of all models. For CLIP-ViT models, GroupNorm small and large are groups of 8 and 16, respectively. For ScatterNets, GroupNorm small is 9 and large is 27. The choice of 27 over 81 is due to its superior performance. All experiments are done at $\varepsilon = 3$.
• Figure 3: Augmentation multiplicity helps in general for CheXpert but not for EyePACS. We evaluate augmentation multiplicity by adding 4 and 8 augmentations of each image in the training data. All experiments are done at $\varepsilon = 3$.
• Figure 4: Pre-training datasets have different impacts: Wide-ResNet, pretrained on ImageNet, performs best on EyePACS, while ViT-G/14 with linear probe surpasses Wide-ResNet 28-10 linear probe across all $\varepsilon$ values on CheXpert. Furthermore, ViT-G/14 achieves near-random performance on EyePACS in zero-shot settings but attains a non-trivial 59.11% AUC on CheXpert.
• Figure 5: Pre-training public data is more beneficial with higher $\varepsilon$ values. For CheXpert, ScatterNet performs better at smaller $\varepsilon$ values, while pretrained models show marginal improvements at larger $\varepsilon$ values. Similarly, for EyePACS, CLIP ViT-G/14 linear performs better as $\varepsilon$ value increases.

Theorems & Definitions (1)

• Definition 1: DworkMNS06DworkKMMN06