Understand
Differential Privacy can provide provable privacy guarantees for training data in machine learning.
- However, the presence of proofs does not preclude the presence of errors.
- Inspired by recent advances in auditing which have been used for estimating lower bounds on differentially private algorithms, here we show that auditing can also be used to find flaws in (purportedly) differentially private schemes.
- In this case study, we audit a recent open source implementation of a differentially private deep learning algorithm and find, with 99.99999999% confidence, that the implementation does not satisfy the claimed differential privacy guarantee.
Built on
The use of confidence or fiducial limits illustrated in the case of the binomial
Charles J Clopper and Egon S Pearson · 1934
Earlier work this paper cites.
The algorithmic foundations of differential privacy
Cynthia Dwork, Aaron Roth, et al · 2014
Earlier work this paper cites.
The composition theorem for differential privacy
Peter Kairouz, Sewoong Oh, and Pramod Viswanath · 2015
Earlier work this paper cites.
Similar
Deep learning with differential privacy
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang · 2016
Cited alongside, same era.
Bug fix: https://github.com/mijungi/vips_code/commit/4e32042b66c960af618722a43c32f3f2dda2730c
2018 · 2018
Cited alongside, same era.
Auditing differentially private machine learning: How private is private sgd?
Matthew Jagielski, Jonathan Ullman, and Alina Oprea · 2020
Cited alongside, same era.
Then
Tensorflow privacy issue #153: Incorrect comparison between privacy amplification by iteration and DP-SGD
Florian Tramer · 2020
Later among the works it cites.
Adversary instantiation: Lower bounds for differentially private machine learning
Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papemoti, and Nicholas Carlin · 2021
Later among the works it cites.
Backpropagation clipping for deep learning with differential privacy
Timothy Stevens, Ivoline C Ngong, David Darais, Calvin Hirsch, David Slater, and Joseph P Near · 2022
Closest in time.
Beyond the bibliography
alphaXiv searches the wider corpus for related work and actual follow-ups.
alphaXiv is searching for related work…