Skip to content
The methodOpen data
Back to the collection

Deep Learning with Differential Privacy

Martín Abadi, Andy Chu, Ian Goodfellow

Show all 7 authors

H. Brendan McMahan, Ilya Mironov, Kunal Talwar, Li Zhang

2016 · arXiv

Security & cryptographyMachine learningAlgorithms
Read the paper
HN score
1
Mentions
3
Readers
3
Months
3
What’s in a score?

From the abstract

Machine learning techniques based on neural networks are achieving remarkable results in a wide variety of domains. Often, the training of models requires large, representative datasets, which may be crowdsourced and contain sensitive information. The models should not expose private information in these datasets. Addressing this goal, we develop new algorithmic techniques for learning and a refined analysis of privacy costs within the framework of differential privacy. Our implementation and experiments demonstrate that we can train deep neural networks with non-convex objectives, under a modest privacy budget, and at a manageable cost in software complexity, training efficiency, and model quality.

Metadata: arXiv. Abstracts retain their original authors’ rights.

In the conversation

Original HN comments, with labels from simple text rules. A label describes the whole comment and may miss context or irony. Read the discussion to make up your own mind. About the labels

3 selected excerpts · 3 total mentions

singhrac
Recommendation · rule
One problem I've found with differential privacy is that no one talks about how to set \epsilon. I've read this book, and it's quite well written and complete, but as the title says it focuses on the algorithmic foundations. This paper [1] is much better for practitioners, and actually gives very reasonable values for the privacy guarantee (e.g., (1.2, 1e-9)), and builds on this great paper: [2]. Worth a read if you train neural networks. [1]: https://arxiv.org/pdf/1710.06963.pdf [2]: https://arxiv.org/pdf/1607.00133.pdf
Original comment The Algorithmic Foundations of Differential Privacy (2014) [pdf]
maximeago
Neutral mention · rule
If the model training is designed to profile just one user, no, the model won't work by design. What you describe is an attack on the privacy of that user and we do want to make sure they fail. The way differential privacy works with machine learning is that it guarantees that one given record cannot have a significant impact on the weights of the models and therefore on its performance. In the particular case of SGD-based models, the guarantee holds for every step of the descent. A good place to start on the topic is Abadi 2016 (https://arxiv.org/pdf/1607.00133.pdf). What is important in the approach is that we don't need to detect that there is something funny in the…
Read the full comment
loss function of the model. Sarus uses the exact same approach whether the model or the loss function is malevolent or not. The guarantees still hold. This is important because a lot of models can extract personal information even with no intention of doing so and no real way to detect it. A good way to think about model performance is that we are looking for models that perform well irrespective of one record. If there are many users that have the same pattern of the user you are trying to spy on, the model may still be good but you won't know whether it's because of that user or not.
Original comment Launch HN: Sarus (YC W22) – Work on sensitive data with differential privacy
chubot
Neutral mention · rule
I admit I geeked out and calculated this a couple months ago, after I was credited on my first academic paper (my career is in programming) If you count video games, I have a Bacon number of 3 because I was credited on Tiger Woods 2003-2005 with an artist named Sylvain Doreau, who is credited on Shrek. John Lithgow was in Shrek and in Footloose with Kevin Bacon. My former coworker Li Zhang has an Erdos number of 2 and we worked together on this paper: https://arxiv.org/abs/1607.00133 (with him doing a lot more work than me). So putting that together is an Erdos-Bacon number of 3 + 3 = 6.
Original comment Paul Erdős: a life that added up to something (1996)

Keep following the thread.

More in Security & cryptography

More from the same topics.