Improving private model utility by minimizing expected loss under noise

Abstract

Improving private model utility by minimizing expected loss under noise is provided. Training of a model is performed to minimize expected loss under noise (ELUN) while maintaining differential privacy. Noise is added to weights of a machine learning model as a random sample drawn from a noise distribution, the noise being added according to a privacy budget. The ELUN is minimized by using a loss function that anticipates the noise added to the weights of the machine learning model to find a point in the parameter space for which the loss is robust to the noise in the weights. The addition of noise and the minimization of ELUN are iterated until the weights converge and satisfy optimization constraints. The model is utilized for arbitrary inputs while protecting privacy of training data used to train the model.

Description

Technical Field

[0001] This disclosure relates to improving the utility of a private model by minimizing the expected loss under noise. Background Technology

[0002] As machine learning has become ubiquitous, even in privacy-sensitive fields, recent research has demonstrated specific privacy threats and explored robust privacy defenses, most notably differential privacy. When machine learning algorithms are applied to private training data, the resulting model may inadvertently reveal information about that data through details of its behavior, structure, or parameters. Summary of the Invention

[0003] Based on one or more illustrative examples, one approach involves training a model to minimize the expected loss under noise (ELUN) while maintaining differential privacy. Noise is added to the weights of the machine learning model as random samples drawn from a noise distribution, the noise being added according to a privacy budget. The ELUN is minimized by using a loss function that anticipates the noise added to the weights of the machine learning model to find a point in the parameter space where the loss is robust to the noise in the weights. The addition of noise and the minimization of the ELUN are iterated until the weights converge and the optimization constraints are satisfied. The model is then utilized for arbitrary inputs while preserving the privacy of the training data used to train the model.

[0004] According to one or more illustrative examples, a system for training and exploiting a model to minimize the expected loss under noise (ELUN) while maintaining differential privacy includes: a memory storing the machine learning model; and a computing device. The computing device is programmed to: add noise as random samples drawn from a noise distribution to the weights of the machine learning model, the noise being added according to a privacy budget; minimize the ELUN by using a loss function that anticipates the noise added to the weights of the machine learning model to find a point in the parameter space for which the loss is robust to the noise in the weights; iterate the addition of noise and the minimization of the ELUN until the weights converge and the optimization constraints are satisfied; and exploit the model for arbitrary inputs while protecting the privacy of the training data used to train the model.

[0005] According to one or more illustrative examples, a non-transitory computer-readable medium includes instructions for training and utilizing a model to minimize the expected loss under noise (ELUN) while maintaining differential privacy. When executed by a processor, the instructions cause the processor to perform operations including: adding noise as random samples drawn from a noise distribution to the weights of a machine learning model, the noise being added according to a privacy budget; minimizing the ELUN by using a loss function that predicts the noise added to the weights of the machine learning model to find a point in the parameter space for which the loss is robust to the noise in the weights; iterating the addition of noise and the minimization of the ELUN until the weights converge and satisfy optimization constraints; and utilizing the model for arbitrary inputs while protecting the privacy of the training data used to train the model. Attached Figure Description

[0006] Figure 1 Examples of non-convex loss functions are provided;

[0007] Figure 2 The diagram illustrates the expected loss of a simple one-dimensional logistic regression problem as a function of weights.

[0008] Figure 3 The illustration shows a first algorithm for generating a differential private model, which is trained to minimize the ELUN;

[0009] Figure 4 The diagram illustrates an alternative algorithm for generating a differential private model, which is trained to minimize the ELUN.

[0010] Figure 5 The diagram illustrates the training and testing accuracy of linear models trained using different methods.

[0011] Figure 6 The illustration depicts an example process for training and utilizing a model to minimize the expected loss under noise while maintaining differential privacy; and

[0012] Figure 7 The illustration shows an example computing device. Detailed Implementation

[0013] This document describes embodiments of the present disclosure. However, it should be understood that the disclosed embodiments are merely examples, and other embodiments may take various forms and alternative forms. The figures are not necessarily to scale; some features may be enlarged or minimized to show details of particular components. Therefore, the specific structural and functional details disclosed herein should not be construed as limiting, but only as a representative basis for teaching those skilled in the art to employ the embodiments in different ways. As will be understood by those skilled in the art, various features illustrated and described with reference to any one figure may be combined with features illustrated in one or more other figures to produce embodiments that are not explicitly illustrated or described. Combinations of illustrated features provide representative embodiments for typical applications. However, various combinations and modifications of features consistent with the teachings of this disclosure may be desired for a particular application or implementation.

[0014] Machine learning has become increasingly prevalent, including in sensitive areas where privacy is a concern. Previous work has highlighted privacy vulnerabilities in machine learning models—in particular, adversaries with access to the model can learn sensitive information about the private data on which the model was trained.

[0015] To combat privacy threats, numerous methods have been proposed, most notably differential privacy, which provides provable privacy guarantees. A typical way to implement differential privacy for linear machine learning models is to add noise to the model's weights. Unfortunately, this noise can often significantly degrade the model's utility.

[0016] While this utility tradeoff may be unavoidable to some extent, it can be mitigated by finding a point in the parameter space where the loss is robust to noise in the weights. This intuition can be built upon improving the utility of the private model.

[0017] As discussed in detail in this paper, the described method involves three contributions. First, a novel loss function—Expected Loss Under Noise (ELUN)—is described, which extends any loss function to anticipate the noise that will be added to the parameters of a linear model. Second, theoretical analysis of ELUN shows that a model trained to minimize ELUN can become differentially private using the same amount of noise that would be needed with the original loss function. This directly suggests the existence of differentially private algorithms for training linear models using ELUN. Third, practical algorithms are provided to obtain models that minimize ELUN with differential privacy.

[0018] One way to achieve differential privacy for linear machine learning models is to add noise to the model's weights. Unfortunately, this noise can often significantly degrade the model's utility. While this utility trade-off may be unavoidable to some extent, it can be mitigated by finding a point in the parameter space where the loss is robust to noise in the weights.

[0019] More formally, a model can be trained that minimizes the expected loss under noise—that is, achieves the minimum possible loss when taking into account the uncertainty on the noisy weights. To do this, the following definition can be used:

[0020] Definition 1: Expected loss under noise. make In model parameters and marker points The loss function defined above Number; and let Let c be the noise distribution above the possible model parameters. Then, the expected loss under noise (ELUN) is... Depend on The following formula is given

[0021]

[0022] The standard distribution used in the context of differential privacy is the Laplace distribution, which has a central tendency. and scale b The probability density function (PDF) Applying this noise distribution to Definition 1, the expected loss under Laplace noise is given by Equation 1:

[0023] (1)

[0024] Note 1 Minimize the expected point Not necessarily with minimizing the expected point same .

[0025] Figure 1 An example of a nonconvex loss function is provided, for which Laplace noise of a suitable large scale is used. However, even for convex loss functions, such as in logistic regression, the optimal parameters may differ when using ELUN.

[0026] For example, consider a one-dimensional logistic regression problem, where the data distribution... Data generation, data distribution as follows:

[0027] 1. y is randomly and uniformly drawn from {0, 1}.

[0028] 2. x is based on —that is, having a mean and variance The normal distribution of the sampled data is as follows: .

[0029] For linear logic models, ,make . The above expected loss can be used as w The function is used to calculate because how the data is generated is known; this is given by Equation 2, when... Selected as Binary cross-entropy When the equation becomes equation 3, equation 2 becomes equation 3.

[0030] (2)

[0031] (3)

[0032] At the same time, when using scale b When dealing with Laplace noise in binary cross-entropy loss, The expected ELUN above is given by Equation 4.

[0033] (4)

[0034] in .

[0035] Figure 2 The diagram illustrates the weights. w The expected loss of a simple one-dimensional logistic regression problem with a function of 200 is given by... =1, = 1:2 (A), 1:0 (B) and 0:8 (C), and b = 1:0 & 2:0. It is worth noting that the optimal weights—that is, the points where the curve reaches its minimum—are larger when using ELUN (Equation 4) than when simply using binary cross-entropy (Equation 3).

[0036] This is due to the asymmetry in the binary cross-entropy loss function; it slightly underestimates the optimal weights when there is no noise. w The cost of the loss is higher than a slight overestimation. Therefore, when noise is added... w In this case, it is preferable to slightly overestimate the weights to avoid the disproportionately high cost of noise leading to too small a weight.

[0037] Differential privacy is a commonly used, strong privacy concept. In the context of machine learning, it is a property of a learning rule that states that the presence or absence of any particular training point does not significantly affect a particular model learned through the rule. More formally, Definition 2 gives differential privacy (declared in the context of ML).

[0038] Define 2-differential privacy (Dwork). make For (randomization) mechanisms, it is used in a given dataset Return in case Model If for all And for all neighboring regions , making ,but yes Differential privacy ,

[0039]

[0040] When using - Differential Private Mechanism Learning Model f At that time, it can be said f It is itself - Differential private.

[0041] A common way to achieve differential privacy is to use non-private mechanisms. M Laplace noise is added to the output. In the context of a linear machine learning model, this corresponds to adding noise to each weight of the trained model. (It should be noted that the use of a linear model is merely an example, and other types of models, such as support vector machines, convolutional neural networks (CNNs), or deep neural networks (DNNs), can be used additionally or alternatively.) The scale of the noise is determined by the privacy budget. and M Sensitivity M The maximum value of the output can be different on adjacent inputs.

[0042] Wu et al. used a variant of strongly consistent RO stability to constrain the sensitivity of a learning rule that learns a linear model on a strongly convex Lipschitz continuous loss function. Their results are summarized in Theorem 1.

[0043] Theorem 1 (Wu et al.) Let M be having -Learning rules for strongly convex loss functions For all ， It is a regulator, and It is relative to of -plum Pschitz. Then the sensitivity of M on a dataset of size n is... limit .

[0044] Therefore, for -Strong convexity - Lipschitz loss function, M By adding a scale Laplace noise becomes - Differential private.

[0045] In the case of commonly used logistic regression or softmax regression for classification problems, It is a binary or categorical cross-entropy, when Depend on When the norm is bounded, it is - Lipschitz. In some cases, such a boundary may be readily available, for example, for images with pixel values ​​in the range [0, 1]; in other cases, it can be achieved through a preprocessing step, in which the values ​​are clipped to obtain the desired result. Adjustments can be added. To make cross-entropy - Strong convexity.

[0046] Note regarding amplitude limits. Appropriate selection should be made for the dataset; however, attention should be paid to data-based selection. The impact on privacy. If If the choice can be made a priori, or if it can be assumed to be public, then there is no privacy issue. If the choice is... For example, as the maximum norm of the data, it might be desirable to choose it in a differential private manner. This is then factored into privacy analytics.

[0047] Proposition 1 If the loss function For all Compared to yes - Lipschitz, then For all Also relative to yes - Lipschitz .

[0048] Proof. Let Therefore c Possible model parameters centered on PDF of the noise distribution above. It can be assumed that... For all Compared to yes - Lipschitz, therefore .make It is ELUN. This gives:

[0049]

[0050] Therefore, for all :

[0051]

[0052] (5)

[0053] (6)

[0054] (7)

[0055] (8)

[0056] By reindexing, we have equation 5, because And following this is equation 6, through the assumption... yes - Lipschitz follows with equation 7, and because It is a probability measure and is followed by equation 8. Therefore, For all Compared to yes - Lipschitz.

[0057] Therefore, Theorem 1 can be applied to ELUN. It corresponds to what needs to be added to the original loss function. The scale of the noise. This provides a way to generate a differential private model, which is trained to minimize ELUN, such as Figure 3 The algorithm described in detail in Algorithm 1 is shown. Due to the sensitivity and therefore the scale of the noise that must be added, the... and Both are the same, therefore the model learned by Algorithm 1 predicts the exact amount of noise added to it. Thus, the resulting model is used for the original loss function. The optimal post-noise model.

[0058] Generally, ELUN (Equation 1) for Laplace noise is not analytically solvable. Numerical solutions are possible; however, in high dimensions, computationally integrating becomes cumbersome because the workload scales exponentially with dimensionality. This means that it is not always possible to efficiently apply Algorithm 1 directly. Therefore, in practice, ELUN is an approximation that can be implemented efficiently via sampling.

[0059] Figure 4 The diagram illustrates ELUN Algorithm 2, which describes a practical alternative to ELUN Algorithm 1. Essentially, it involves choosing the resolution. R And via drawing from the Laplace distribution R Random samples are used to approximate the expectation over noise. In practice, argmin can be found via standard optimization algorithms such as gradient descent.

[0060] Note that in the limit, and the integral converges over the probability density function, and Proposition 1 still applies by essentially the same proof (by utilizing and replacing the integral, and utilizing...). replace Therefore, the model returned by Algorithm 2 is also... - Differential private.

[0061] As noted in Note 1, ELUN allows us to specify a model that may be better than a post-noise model trained using the original loss function (e.g., as done by Wu et al.). Evidence is now shown that this potential advantage can be realized in practice; the utility of a differential private model trained using ELUN tends to exceed that of a differential private model trained using cross-entropy, especially for... Smaller values ​​(greater privacy protection).

[0062] Figure 5 The figures illustrate the training and test accuracy of linear models trained using different methods. As shown, each figure indicates the training and test accuracy on various datasets for various... The values ​​represent the training and testing accuracy using Algorithm 2 (blue, solid line) without differential privacy (black, dotted line), with output perturbation (red, dotted line). The results are averaged over 100 trials on each dataset, where... =0.05, =2.0, and R = 50.

[0063] for For the smallest value (where privacy guarantees are optimal), Algorithm 2 consistently and often outperforms previous work with a significant margin. For large values... Both differential private models perform close to the performance of the non-private model; however, it is important to note that for large... Privacy guarantees become meaningless, as shown by Yeom et al.

[0064] It is worth noting that the parameters learned using ELUN generalize well; despite the fact that ELUN is minimized on the training data, Algorithm 2 also outperforms previous work on the test data.

[0065] Therefore, for small (Corresponding to strong privacy guarantees), the differential private training mechanism produces models that outperform currently comparable state-of-the-art methods.

[0066] Figure 6 An example process 600 for training and utilizing a model to minimize the expected loss under noise (ELUN) while maintaining differential privacy is illustrated. In the example, process 600 can be performed by one or more computing devices, such as computing device 700 described herein.

[0067] In Operation 602, noise is added as a random sample drawn from a noise distribution to the weights of the machine learning model. In this example, the noise can be added according to a privacy budget. The noise can be Laplace noise drawn according to the probability density function of a normal distribution, where the noise is approximated by random samples drawn from the Laplace distribution. It should be noted that this is just an example, and other noise distributions, such as Gaussian noise, can be used. The machine learning model can be a linear model.

[0068] In operation 604, ELUN is minimized by using a loss function that anticipates the noise added to the weights of the machine learning model to find a point in the parameter space where the loss is robust to the noise in the weights. Minimizing ELUN can include using standard optimization algorithms such as gradient descent.

[0069] In operation 606, the model is evaluated to determine whether the model parameters have converged and whether the given optimization constraints are satisfied. If not, control returns to operation 602 to perform another iteration. If yes, the model is considered complete, and control proceeds to operation 608.

[0070] In operation 608, the model is utilized for any input while protecting the privacy of the training data used to train the model. After operation 606, process 600 ends.

[0071] Figure 7An example computing device 700 is illustrated. The algorithms and / or method techniques of one or more embodiments discussed herein can be implemented using such a computing device. The computing device 700 may include memory 702, processor 704, and non-volatile storage device 706. Processor 704 may include one or more devices selected from high-performance computing (HPC) systems, including high-performance cores, microprocessors, microcontrollers, digital signal processors, microcomputers, central processing units, field-programmable gate arrays, programmable logic devices, state machines, logic circuits, analog circuits, digital circuits, or any other device that manipulates signals (analog or digital) based on computer-executable instructions residing in memory 702. Memory 702 may include a single memory device or multiple memory devices, including but not limited to random access memory (RAM), volatile memory, non-volatile memory, static random access memory (SRAM), dynamic random access memory (DRAM), flash memory, cache memory, or any other device capable of storing information. Non-volatile storage device 706 may include one or more persistent data storage devices, such as hard disk drives, optical drives, tape drives, non-volatile solid-state devices, cloud storage devices, or any other device capable of persistently storing information.

[0072] Processor 704 can be configured to read into memory 702 and execute computer-executable instructions residing in non-volatile storage device 706, embodying algorithms and / or method techniques of one or more embodiments. Program instructions 708 may include operating systems and applications. Program instructions 708 can be compiled or interpreted from computer programs created using various programming languages ​​and / or techniques, which, without limitation, and individually or in combination, include Java, C, C++, C#, Objective C, Fortran, Pascal, JavaScript, Python, Perl, and PL / SQL. In one embodiment, PyTorch, as a package of the Python programming language, can be used to implement code for machine learning models of one or more embodiments.

[0073] When executed by processor 704, the computer-executable instructions of program instructions 708 can cause computing device 700 to implement one or more algorithms and / or methods disclosed herein. Non-volatile storage device 706 may also include data 710 supporting the functionality, features, and processes of one or more embodiments described herein. As some examples, the data 710 may include training data, models, sampled noise, model inputs, and model outputs.

[0074] The processes, methods, or algorithms disclosed herein may be deliverable to / implemented by a processing device, controller, or computer, which may include any existing programmable electronic control unit or dedicated electronic control unit. Similarly, processes, methods, or algorithms may be stored in various forms as data and instructions executable by a controller or computer, including but not limited to information permanently stored on non-writable storage media such as ROM devices and information changeably stored on writable storage media such as floppy disks, magnetic tapes, CDs, RAM devices, and other magnetic and optical media. Processes, methods, or algorithms may also be implemented in a software executable object. Alternatively, suitable hardware components (such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), state machines, controllers) or other hardware components or devices, or a combination of hardware, software, and firmware components, may be used to embody processes, methods, or algorithms, wholly or partially.

[0075] While exemplary embodiments have been described above, they are not intended to describe all possible forms covered by the claims. The language used in this specification is descriptive rather than limiting, and it should be understood that various changes may be made without departing from the spirit and scope of this disclosure. As previously stated, features of various embodiments may be combined to form other embodiments of the invention that may not be explicitly described or illustrated. While various embodiments may have been described as providing advantages over other embodiments or prior art implementations in one or more desired features, or being preferred over other embodiments or prior art implementations, those skilled in the art will recognize that one or more features or characteristics may be compromised to achieve desired overall system properties depending on the specific application and implementation. These properties may include, but are not limited to, cost, strength, durability, lifecycle cost, merchantability, appearance, packaging, size, suitability, weight, manufacturability, ease of assembly, etc. Accordingly, any embodiment described as less desirable in one or more features than other embodiments or prior art is not outside the scope of this disclosure and may be desirable for a particular application.

Claims

1. A method for training and utilizing a model to minimize expected loss under noise while maintaining differential privacy, the method comprising: Noise is added as a random sample drawn from a noise distribution to the weights of a machine learning model, and the noise is added according to a privacy budget. The expected loss under noise is minimized by using a loss function that anticipates the noise added to the weights of the machine learning model in order to find a point in the parameter space for which the loss is robust to noise in the weights. Iterate through the addition of noise and the minimization of the expected loss under noise until the weights converge and the optimization constraints are satisfied. and The model can be used for any input while protecting the privacy of the training data used to train the model.

2. The method of claim 1, wherein the noise comprises Laplace noise.

3. The method of claim 1, wherein the noise comprises Gaussian noise.

4. The method of claim 1, wherein the noise is approximated by random samples drawn from a Laplace distribution.

5. The method according to claim 1, wherein the machine learning model is a linear machine learning model.

6. The method of claim 1, wherein the machine learning model comprises one or more of a support vector machine, a convolutional neural network (CNN), or a deep neural network (DNN).

7. The method of claim 1, wherein minimizing the expected loss under noise comprises optimization based on gradient descent.

8. The method of claim 1, wherein the expected loss under noise is determined by... The symbol is given by the following formula: ， in, In model parameters θ and marker points The loss function defined above; θ' It minimizes the expected The parameter points, and It is the noise distribution above the possible model parameters.

9. A system for training and utilizing a model to minimize expected loss under noise while maintaining differential privacy, the system comprising: Memory for storing machine learning models; and Computing devices, programmed to Noise is added as a random sample drawn from a noise distribution to the weights of a machine learning model, and the noise is added according to a privacy budget. The expected loss under noise is minimized by using a loss function that anticipates the noise added to the weights of the machine learning model in order to find a point in the parameter space for which the loss is robust to noise in the weights. Iterate through the addition of noise and the minimization of the expected loss under noise until the weights converge and the optimization constraints are satisfied. and The model can be used for any input while protecting the privacy of the training data used to train the model.

10. The system of claim 9, wherein the noise comprises one or more of Laplace noise or Gaussian noise.

11. The system of claim 9, wherein the noise is approximated by random samples drawn from a Laplace distribution.

12. The system of claim 9, wherein the machine learning model comprises one or more of a linear machine learning model, a support vector machine, a convolutional neural network (CNN), or a deep neural network (DNN).

13. The system of claim 9, wherein minimizing the expected loss under noise includes optimization based on gradient descent.

14. The system of claim 9, wherein the expected loss under noise is caused by The symbol is given by the following formula: ， in, In model parameters θ and marker points The loss function defined above; θ' It minimizes the expected The parameter points, and It is the noise distribution above the possible model parameters.

15. A non-transitory computer-readable medium comprising instructions for training and utilizing a model to minimize expected loss under noise while maintaining differential privacy, the instructions, when executed by a processor, causing the processor to perform operations including: Noise is added as a random sample drawn from a noise distribution to the weights of a machine learning model, and the noise is added according to a privacy budget. The expected loss under noise is minimized by using a loss function that anticipates the noise added to the weights of the machine learning model in order to find a point in the parameter space for which the loss is robust to noise in the weights. Iterate through the addition of noise and the minimization of the expected loss under noise until the weights converge and the optimization constraints are satisfied. and The model can be used for any input while protecting the privacy of the training data used to train the model.

16. The medium of claim 15, wherein the noise comprises one or more of Laplace noise or Gaussian noise.

17. The medium of claim 15, wherein the noise is approximated by random samples drawn from a Laplace distribution.

18. The medium according to claim 15, wherein the machine learning model is a linear machine learning model.

19. The medium of claim 15, wherein minimizing the expected loss under noise includes optimization based on gradient descent.

20. The medium according to claim 15, wherein the expected loss under noise is caused by The symbol is given by the following formula: ， in, In model parameters θ and marker points The loss function defined above; θ' It minimizes the expected The parameter points, and It is the noise distribution above the possible model parameters.

Images