Differentially Private Bayesian Neural Networks on Accuracy, Privacy and Reliability

Abstract

Bayesian neural network (BNN) allows for uncertainty quantification in prediction, offering an advantage over regular neural networks that has not been explored in the differential privacy (DP) framework. We fill this important gap by leveraging recent development in Bayesian deep learning and privacy accounting to offer a more precise analysis of the trade-off between privacy and accuracy in BNN. We propose three DP-BNNs that characterize the weight uncertainty for the same network architecture in distinct ways, namely DP-SGLD (via the noisy gradient method), DP-BBP (via changing the parameters of interest) and DP-MC Dropout (via the model architecture). Interestingly, we show a new equivalence between DP-SGD and DP-SGLD, implying that some non-Bayesian DP training naturally allows for uncertainty quantification. However, the hyperparameters such as learning rate and batch size, can have different or even opposite effects in DP-SGD and DP-SGLD.Extensive experiments are conducted to compare DP-BNNs, in terms of privacy guarantee, prediction accuracy, uncertainty quantification, calibration, computation speed, and generalizability to network architecture. As a result, we observe a new tradeoff between the privacy and the reliability. When compared to non-DP and non-Bayesian approaches, DP-SGLD is remarkably accurate under strong privacy guarantee, demonstrating the great potential of DP-BNN in real-world tasks.

Software reliability prediction: A survey

“…Examples of Bayesian neural network papers from major journals and conferences are reviewed in Table 4. 80,[91][92][93][94][95][96][97]…”

Improving Adversarial Robustness for Free with Snapshot Ensemble

“…The algorithm, while keeping the time spent on robust training almost equal to the non-robust ones, also produces robust models. Instead of perturbing the dataset, we apply the Snapshot Ensemble [Huang et al, 2017a, Smith, 2017, Loshchilov and Hutter, 2016 along the training process to store multiple historical weights so as to defend against adversarial attacks such as FGSM or PGD, in a Bayesian Neural Network [Blundell et al, 2015, Kingma et al, 2015, Ru et al, 2019, Zhang et al, 2021 manner. The proposed method produces results as fast as the non-robust networks, with only a few seconds difference when trained on CIFAR-10 [ Krizhevsky et al, 2009] and MNIST [LeCun, 1998] datasets.…”

Fast and Accurate Variational Inference for Large Bayesian VARs with Stochastic Volatility

“…Differentially private posterior sampling has recently gained attractions, with the methods falling into three categories: DP Metropolis-Hastings (Heikkilä et al, 2019;Yıldırım & Ermis ¸, 2019), DP Gradient-based MCMC (Li et al, 2019;Zhang et al, 2021;Räisä et al, 2021), and DP Exact Posterior Sampling (Dimitrakakis et al, 2014;Wang et al, 2015;Foulds et al, 2016;Zhang et al, 2016) DP Metropolis-Hastings Differentially private Metropolis-Hastings has been developed in Heikkilä et al (2019); Yıldırım & Ermis ¸(2019). Heikkilä et al (2019) gives an algorithm based on the Barker acceptance test, which can be used with a minibatch of data.…”

“…DP Gradient-based MCMC Another line of work studies (stochastic) gradient-based MCMC methods (Li et al, 2019;Zhang et al, 2021;Räisä et al, 2021). Differentially private Stochastic Gradient MCMC (SGMCMC), including Stochastic Gradient Langevin Dynamics (SGLD) (Welling & Teh, 2011) and other variants, are shown to satisfy differential privacy guarantees by default.…”

“…While there exists a few DP MCMC algorithms, they have significant limitations on their utility and applicability. In particular, most work has no guarantees on the asymptotic convergence or the convergence speed, thus could diverge far away from the target posterior in practice (Heikkilä et al, 2019;Li et al, 2019;Zhang et al, 2021). Some work significantly scarifies the convergence rate for privacy and can not scale to large datasets (Yıldırım & Ermis ¸, 2019).…”