Bolt-on Differential Privacy for Scalable Stochastic Gradient Descent-based Analytics

Abstract

While significant progress has been made separately on analytics systems for scalable stochastic gradient descent (SGD) and private SGD, none of the major scalable analytics frameworks have incorporated differentially private SGD. There are two inter-related issues for this disconnect between research and practice: (1) low model accuracy due to added noise to guarantee privacy, and (2) high development and runtime overhead of the private algorithms. This paper takes a first step to remedy this disconnect and proposes a private SGD algorithm to address both issues in an integrated manner. In contrast to the whitebox approach adopted by previous work, we revisit and use the classical technique of output perturbation to devise a novel "bolt-on" approach to private SGD. While our approach trivially addresses (2), it makes (1) even more challenging. We address this challenge by providing a novel analysis of the L 2 -sensitivity of SGD, which allows, under the same privacy guarantees, better convergence of SGD when only a constant number of passes can be made over the data. We integrate our algorithm, as well as other state-of-the-art differentially private SGD, into Bismarck, a popular scalable SGD-based analytics system on top of an RDBMS. Extensive experiments show that our algorithm can be easily integrated, incurs virtually no overhead, scales well, and most importantly, yields substantially better (up to 4X) test accuracy than the state-of-the-art algorithms on many real datasets.

Rényi Differentially Private ADMM for Non-Smooth Regularized Optimization

“…Many differentially private ERM algorithms cannot be applied to L 1 regularized classification, such as ObjPert [1], [2], OutPert [40], PVP and DVP [5], PSGD [16], and RSGD [7]. Therefore, we compare our proposed algorithms with these baselines: DP-SGD [4], DP-ADMM [25], ADMM-objP [28], and Non-Private approach.…”

Privacy-Preserving Tensor Factorization for Collaborative Health Data Analysis

“…EASGD helps reduce the communication cost by allowing sites to perform multiple iterations (each iteration is one pass of the local data) before sending the updated factor matrices. We further extend the local optimization updates using permutation-based SGD (P-SGD), a practical form of SGD [29]. In P-SGD, instead of randomly sampling one instance from the tensor at a time, the nonzero elements are rst shu ed within the tensor.…”

Duet: an expressive higher-order language and linear type system for statically enforcing differential privacy

“…Finally, we implement several differentially private machine learning algorithms in Duet which have never before been automatically verified by a language-based tool, and we present experimental results which demonstrate the benefits of Duet's language design in terms of accuracy of trained machine learning models. privacy provides a robust solution to this problem, and as a result, a number of differentially private algorithms have been developed for machine learning [3,13,17,28,42,50,51,54].Few practical approaches exist, however, for automatically proving that a general-purpose program satisfies differential privacy-an increasingly desirable goal, since many machine learning pipelines are expressed as programs that combine existing algorithms with custom code. Enforcing differential privacy for a new program currently requires a new, manually-written privacy proof.…”

“…Finally, we implement several differentially private machine learning algorithms in Duet which have never before been automatically verified by a language-based tool, and we present experimental results which demonstrate the benefits of Duet's language design in terms of accuracy of trained machine learning models. privacy provides a robust solution to this problem, and as a result, a number of differentially private algorithms have been developed for machine learning [3,13,17,28,42,50,51,54].…”

“…gd-output-perturbation(xs, ys, k, η, ϵ, δ ) ≜ let m 0 = zeros (cols X ) in let c = box (mclip L2 xs) inlet s = real k/real b in mgauss[s, ϵ, δ ] <xs, ys> { loop k on m 0 { a, θ ⇒ mfold-row b, θ, unbox c, ys { θ, xb, yb ⇒ let д = ∇ LR L2 [θ ; xb, yb] in θ − η · д } } }An alternative to gradient perturbation is output perturbation-adding noise to the final trained model, rather than during the training process. Wu et al[54] present a competitive algorithm based on this idea, which works by bounding the total sensitivity (rather than privacy) of the iterative gradient descent process. Their algorithm leverages parallel composition for sensitivity: it divides the dataset into small chunks called minibatches, and each iteration of the algorithm processes one minibatch.…”