CoChat
Sign Up
PreprintCited by 23Privacy-Preserving Technologies in DataStochastic Gradient Optimization TechniquesCryptography and Data Security

The DOI matches its DataCite record.

Tempered Sigmoid Activations for Deep Learning with Differential Privacy

Open access
Papernot, Nicolas, Thakurta, Abhradeep, Song, Shuang, Chien, Steve, Erlingsson, Úlfar·2020·arXiv
DOI 10.48550/arxiv.2007.14191arXiv 2007.14191
Open this paper in CoChat — free accountOpen PDF

Abstract

Because learning sometimes involves sensitive data, machine learning algorithms have been extended to offer privacy for training data. In practice, this has been mostly an afterthought, with privacy-preserving models obtained by re-running training with a different optimizer, but using the model architectures that already performed well in a non-privacy-preserving setting. This approach leads to less than ideal privacy/utility tradeoffs, as we show here. Instead, we propose that model architectures are chosen ab initio explicitly for privacy-preserving training. To provide guarantees under the gold standard of differential privacy, one must bound as strictly as possible how individual training points can possibly affect model updates. In this paper, we are the first to observe that the choice of activation function is central to bounding the sensitivity of privacy-preserving deep learning. We demonstrate analytically and experimentally how a general family of bounded activation functions, the tempered sigmoids, consistently outperform unbounded activation functions like ReLU. Using this paradigm, we achieve new state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10 without any modification of the learning procedure fundamentals or differential privacy analysis.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2007.14191

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Several of these problems relate to previous work on multiple-source adaptation and agnostic federated learning.

    “Several of these problems relate to previous work on multiple-source adaptation and agnostic federated learning [329, 330, 234, 352].”

    From Advances and Open Problems in Federated Learning (2021) · cites this paper as [352]

    The Introduction (p. 1) and Conclusions (p. 8) discuss differentially private training and activation functions, not multiple-source adaptation or agnostic federated learning. Searches for both terms found no passage in our copy addressing the claimed relationship. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Still being checked.

Research works printed but not linked: 15

  1. [1][1] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages 308-318. ACM, 2016. -
  2. [2][2] Ehsan Amid, Manfred KK Warmuth, Rohan Anil, and Tomer Koren. Robust bi-tempered logistic loss based on bregman divergences. In Advances in Neural Information Processing Systems , pages 14987-14996, 2019. -
  3. [3][3] Brendan Avent, Javier Gonzalez, Tom Diethe, Andrei Paleyes, and Borja Balle. Automatic discovery of privacy-utility pareto fronts. arXiv preprint arXiv:1905.10862 , 2019. - · arXiv
  4. [5][5] Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Science , pages 464-473. IEEE, 2014. -
  5. [6][6] Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In USENIX Security Symposium , 2019. -
  6. [7][7] Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research , 12(Mar):1069-1109, 2011. -
  7. [8][8] Thomas Desautels, Andreas Krause, and Joel W Burdick. Parallelizing exploration-exploitation tradeoffs in gaussian process bandit optimization. Journal of Machine Learning Research , 15:3873-3923, 2014. -
  8. [10][10] Cynthia Dwork, Vitaly Feldman, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Aaron Roth. The reusable holdout: Preserving validity in adaptive data analysis. Science , 349(6248):636-638, 2015. -
  9. [11][11] Vitaly Feldman. Does learning require memorization? a short tale about a long tail. arXiv preprint arXiv:1906.05271 , 2019. - · arXiv
  10. [13][13] Igor Kononenko. Machine learning for medical diagnosis: history, state of the art and perspective. Artificial Intelligence in medicine , 23(1):89-109, 2001. -
  11. [16][16] Vinod Nair and Geoffrey E Hinton. Rectified linear units improve restricted boltzmann machines. In Proceedings of the 27th international conference on machine learning (ICML-10) , pages 807-814, 2010. -
  12. [18][18] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 3-18. IEEE, 2017. -
  13. [19][19] Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models. arXiv preprint arXiv:1811.00513 , 2019. - · arXiv
  14. [20][20] Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference on Signal and Information Processing , pages 245-248. IEEE, 2013. -
  15. [23][23] Jingzhao Zhang, Tianxing He, Suvrit Sra, and Ali Jadbabaie. Why gradient clipping accelerates training: A theoretical justification for adaptivity. In International Conference on Learning Representations , 2019.

Cited by

Sorted by citations

Related

Metadata

Authors
Papernot, N., Thakurta, A., Song, S., Chien, S., & Erlingsson, Ú.
Affiliations
Google (United States) (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2020
Pages
9312-9321
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2007.14191
arXiv
2007.14191
OpenAlex
W3176917011
Cited by
23
References
0
Citations by year
2025: 1 · 2022: 2 · 2021: 16 · 2020: 4
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Stochastic Gradient Optimization Techniques
  • Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
Keywords
differential privacy, privacy-preserving deep learning, privacy-utility trade-off, ReLU, image classification accuracy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review