Training privacy-sensitive neural networks using data augmentation

Abstract

A method, system, and apparatus, including a computer program encoded on a computer storage medium, for privacy sensitive training of a neural network. In one aspect, the method includes training a set of neural network parameters of a neural network on a set of training data over multiple training iterations to optimize an objective function. Each training iteration includes sampling a batch of network inputs from the set of training data, determining clipped gradients for each network input in the batch of network inputs, and updating the neural network parameters using the clipped gradients for the network inputs in the batch of network inputs.

Description

[Technical Field]

[0001] This specification relates to processing data using machine learning models. [Background technology]

[0002] Machine learning models receive input and generate an output, such as a predicted output, based on the received input. Some machine learning models are parametric models, which generate an output based on the received input and the values ​​of the model's parameters.

[0003] Some machine learning models are deep models that employ multiple layers of the model to produce an output for an incoming input. For example, a deep neural network is a deep machine learning model that includes an output layer and one or more hidden layers, each applying a nonlinear transformation to an incoming input to produce an output. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Abadi, Martin, et al., "Deep learning with differential privacy," minutes of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016). [Overview of the project] [Means for solving the problem]

[0005] This specification generally describes a training system implemented as a computer program on one or more computers in one or more locations for performing privacy-sensitive training of neural networks.

[0006] According to one embodiment, a method is provided for privacy-sensitive training of a neural network, which is performed by one or more computers. The method includes training a set of neural network parameters of a neural network on a set of training data over multiple training iterations to optimize an objective function, the method including, in each training iteration, the steps of: generating a plurality of augmented versions of the network input for each network input in the batch of network inputs, where each augmented version of the network input is obtained by applying a respective augmentation transformation to the network input; determining a gradient of the objective function for each of the plurality of augmented versions of the network input; determining a combined gradient for the network input by combining the gradients determined for the plurality of augmented versions of the network input; and generating a clipped gradient for the network input by clipping the combined gradient for the network input; and updating the neural network parameters using the clipped gradient for the network input in the batch of network inputs.

[0007] In some implementations, the step of generating multiple extended versions of a network input includes, for each extended transformation, the step of obtaining multiple extended transformations, which includes the step of randomly sampling the parameters that define the extended transformation, and the step of generating each extended version of the network input by applying each extended transformation to the network input.

[0008] In some implementations, the step of determining the gradient of the objective function with respect to an extended version of the network input includes the steps of processing the extended version of the network input using the neural network according to the current values ​​of the neural network parameters of the neural network to produce a corresponding network output, and determining the gradient of the objective function with respect to the neural network parameters of the neural network when the objective function is evaluated with respect to the network output.

[0009] In some implementations, the step of determining the coupling gradient for the network input includes the step of averaging the gradients determined for multiple extended versions of the network input.

[0010] In some implementations, for one or more of the network inputs, the step of generating a clipped gradient to the network inputs includes scaling the connected gradient to the network inputs to satisfy a clipping threshold to the norm of the connected gradient to the network inputs.

[0011] In some implementations, the step of scaling the coupling gradient to the network input so that the norm of the coupling gradient to the network input satisfies a clipping threshold includes the step of scaling the coupling gradient to the network input by a scaling factor defined as the ratio of (i) the clipping threshold to (ii) the norm of the coupling gradient to the network input.

[0012] In some implementations, the method further includes generating a set of noise parameters, which involves randomly sampling noise parameters from a noise distribution before updating the neural network parameters using clipped gradients to the network inputs in a batch of network inputs, and applying the noise parameters to the clipped gradients to the network inputs in a batch of network inputs.

[0013] In some implementations, the noise distribution includes a Gaussian noise distribution.

[0014] In some implementations, the neural network does not include any batch normalization layer.

[0015] In some implementations, neural networks include a group normalization layer.

[0016] In some implementations, neural networks are configured to process network inputs, including images.

[0017] In some implementations, neural networks are configured to process network inputs that include audio data.

[0018] In some implementations, neural networks are configured to process network inputs, including electronic medical record data.

[0019] In some implementations, neural networks are configured to process inputs that include text data.

[0020] In some implementations, a neural network includes one or more convolutional neural network layers.

[0021] In some implementations, the objective function includes a classification loss.

[0022] In some implementations, each training iteration contains at least 4000 network inputs in a batch of network inputs.

[0023] In some implementations, the step of generating multiple extended versions of the network input includes the step of generating at least eight extended versions of the network input.

[0024] In another embodiment, a system is provided of one or more non-temporary computer storage media that, when executed by one or more computers, stores instructions causing one or more computers to perform the operation of the above-described method.

[0025] In another embodiment, a system is provided comprising one or more computers and one or more storage devices communicably coupled to one or more computers, wherein one or more storage devices store instructions that, when executed by one or more computers, cause one or more computers to perform the operation of the method described above.

[0026] Throughout this specification, a “batch” of network inputs can refer to a set of one or more network inputs. For example, a batch of network inputs may include 5 network inputs, 10 network inputs, 100 network inputs, 1000 network inputs, 5000 network inputs, or any other appropriate number of network inputs.

[0027] A neural network can have any suitable neural network architecture. For example, a neural network can have any suitable number of layers (e.g., 5, 10, or 100 layers) and can include any suitable type of neural network layers (e.g., fully connected layers, convolutional layers, attention layers, recurrent layers, etc.) connected in any suitable configuration (e.g., as a linear array of layers or as a directed graph of layers).

[0028] A neural network can be configured to perform any suitable machine learning task.

[0029] More specifically, a neural network may be configured to process any suitable network input, including, for example, one or more of the following: images, audio waveforms, point clouds (e.g., generated by a lidar or radar sensor), protein representations, sequences of words (e.g., forming one or more sentences or paragraphs), videos (e.g., sequences represented by video frames), or combinations thereof.

[0030] A neural network can be configured to generate any network output that characterizes the network input. For example, the network output could be a classification output, a regression output, a sequence output (i.e., a sequence of output elements), a segmentation output, or a combination thereof.

[0031] Several examples of machine learning tasks that can be performed by neural networks are described in more detail below.

[0032] In some implementations, a neural network is configured to process network inputs representing image pixels in order to generate a classification output. The classification output may include a score for each class within a set of classes, where the score for a class defines the likelihood that the image belongs to that class. Several examples of classification tasks that can be performed by neural networks are described below.

[0033] In one example, a neural network performs an object classification task. In this example, each class in a set of classes corresponds to a specific object category, and an image is included in a class if the class represents an object within that object category. Examples of object categories include, for example, vehicles, pedestrians, and cyclists.

[0034] In another example, a neural network can perform an action classification task. In this example, each class in a set of classes corresponds to a specific action, and if a class represents a person performing the action corresponding to that class, then an image is included within that class. Examples of actions include sitting, standing, running, walking, and so on.

[0035] In another example, a neural network can process medical images (e.g., ultrasound images, computed tomography (CT) images, or magnetic resonance (MR) images) to perform a medical classification task. In this example, each class in the set of classes corresponds to a medical category, and an image is included in the class if the class represents tissue exhibiting the characteristics of the medical category to which the class corresponds. Examples of medical categories include, for example, cancerous and non-cancerous tissue.

[0036] In another example, a neural network can process biometric images (for example, images showing human eyes) to perform a discriminative classification task. In this example, each class in a set of classes can correspond to a person, and a biometric image is included in a class if that class represents (at least some of) the people corresponding to that class.

[0037] In some implementations, a neural network is configured to process network inputs representing audio samples within an audio waveform in order to perform speech recognition, that is, to generate outputs that define sequences of phonemes, graphemes, characters, or words corresponding to the audio waveform.

[0038] In some implementations, a neural network is configured to process a network input representing words in a sequence of words in order to perform natural language processing tasks, such as topic classification or summarization. To perform topic classification, the neural network generates an output containing a score for each topic category within a set of possible categories (e.g., sports, business, science, etc.). The score for a topic category can define the likelihood that the sequence of words relates to that topic category. To perform summarization, the neural network generates an output containing an output sequence of words that is shorter than the input sequence of words and incorporates important or relevant information from the input sequence of words.

[0039] In some implementations, a neural network performs a machine translation task by processing network inputs that represent sequences of text in one language, such as sequences of words, phrases, characters, or word fragments, in order to produce an output that may be a sequence of text in another language, i.e., a translation of an input sequence of text. A specific example of this task might be a multilingual machine translation task, where the neural network is configured to translate between multiple different source-and-target language pairs. In this example, the source language texts may be augmented with identifiers that indicate the target language to which the neural network should translate the source language texts.

[0040] In some implementations, neural networks are configured to perform audio processing tasks. For example, if the network input represents spoken utterances, the output produced by the neural network could be a score for each of a set of text fragments, each score representing the estimated likelihood that the text fragment is an accurate transcription of the utterance. As another example, if the network input represents spoken utterances, the output produced by the neural network could indicate whether a particular word or phrase ("hotword") was spoken in the utterance. As yet another example, if the network input represents spoken utterances, the output produced by the neural network could identify the natural language in which the utterances were spoken.

[0041] In some implementations, neural networks are configured to perform natural language processing or comprehension tasks, such as implication tasks, paraphrasing tasks, text similarity tasks, sentiment tasks, sentence completion tasks, and grammaticality tasks, operating on a set of network inputs representing text in several natural languages.

[0042] In some implementations, a neural network is configured to perform a text-to-speech task, where the network input represents text in natural language or features of text in natural language, and the network output is a spectrogram, waveform, or other data that defines the audio of the text being spoken in natural language.

[0043] In some implementations, a neural network is configured to perform a health prediction task, where the network input represents data derived from electronic health record data for a patient, and the output is a prediction related to the patient's future health, such as a predicted treatment to be prescribed to the patient, the likelihood of an adverse health event occurring to the patient, or a predicted diagnosis for the patient.

[0044] In some implementations, a neural network is configured to perform a text generation task, where the network input represents a sequence of text and the output is another sequence of text, such as a completion of the input sequence, a response to a question stated in the input sequence, or a sequence of text about a topic specified by the first sequence of text. As another example, the network input can represent non-text data, such as an image, and the output sequence may be text describing the data represented by the network input.

[0045] In some implementations, neural networks are configured to perform genomics tasks, where the network input represents a DNA sequence or other molecular sequence fragment, and the output includes, for example, promoter site prediction, methylation analysis, and predictions for the functional effects of non-coding variants.

[0046] In some implementations, neural networks are configured to perform protein modeling tasks, for example, where the network input represents a protein and the network output characterizes the protein. For instance, the network output might characterize the protein's predicted stability or its predicted structure.

[0047] In some implementations, the neural network is configured to perform a point cloud processing task, for example, where the network input represents a point cloud (e.g., generated by a lidar or radar sensor), and the network output characterizes, for example, the type of object represented by the point cloud.

[0048] In some implementations, a neural network is configured to perform multiple individual machine learning tasks, such as two or more combinations of the machine learning tasks described above. For example, a neural network may be configured to perform multiple individual natural language understanding tasks by processing a network input containing identifiers for individual natural language understanding tasks to be performed on the network input.

[0049] The subject matter described herein may be implemented in particular embodiments to achieve one or more of the following advantages:

[0050] The training systems described herein can train neural networks to perform machine learning tasks using privacy-sensitive training techniques that mitigate the risk of privacy attacks. A privacy attack on a neural network can refer to actions taken to extract information about the set of training data used to train a neural network, for example, by exposing individual training examples used during the training of the neural network (e.g., including individual network inputs). Privacy attacks can result in the disclosure of sensitive information. If left unaddressed, the risk of privacy attacks may limit the deployment of machine learning models trained on sensitive datasets.

[0051] In other words, training a neural network using data augmentation can be described as generating an augmented version of the network input by applying an augmentation transformation to the network input and then using the augmented version of the network input to train the neural network. Training a neural network using data augmentation can improve the robustness and predictive accuracy of the neural network, for example, by reducing the likelihood of overfitting and by reducing the amount of training data required to train the neural network. Reducing the amount of training data required to train the neural network can allow for reduced consumption of computational resources, such as memory and computing power, during training. However, conventional methods for performing data augmentation can result in a significantly increased privacy cost during training, meaning that the neural network becomes more vulnerable to privacy attacks. In detail, the privacy cost incurred by performing conventional data augmentation may scale linearly with the number of augmented versions generated for each training example.

[0052] The training system described herein addresses this problem by implementing a form of data augmentation that gains the benefits of data augmentation without incurring any additional privacy loss. In detail, the training system can generate a combined gradient to a network input by combining gradients derived from multiple augmented versions of the network input, clip the combined gradient, and then update the parameter values ​​of the neural network using the clipped gradient. Combining gradients derived from augmented versions of the network input allows the training system to generate more sophisticated gradients that encode more information from the network input. Clipping the combined gradients generated from each network input before using the combined gradient to update the neural network parameters limits the influence of any individual network input on the neural network parameters and thus contributes to strengthening the robustness of the neural network against privacy attacks.

[0053] This statement and implication is not made here that a model "contains" its training dataset in the sense that the model contains a copy or version of that dataset. Rather, a model may contain ("memorize") attributes of its training data such that, in some cases, it can statistically generate content that is a close approximation of elements of that training data when it follows rules and uses such attributes. Content that is repeated many times in the training dataset is likely to be among the content that the model can be guided to closely approximate. However, such close approximations occur exceptionally rarely and are often produced only through specific tasks designed to generate them.

[0054] Details of one or more embodiments of the subject matter of this specification are described in the accompanying drawings and the following description. Other features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. [Brief explanation of the drawing]

[0055] [Figure 1] This is a block diagram of an exemplary training system for performing privacy-sensitive training of a neural network. [Figure 2] This is a flowchart illustrating an exemplary process for training a neural network in a privacy-sensitive manner. [Figure 3] This is a flowchart illustrating an exemplary process for determining the clipped gradient of a network input to a neural network. [Figure 4] This is a table of training and validation dataset accuracy for neural networks under various hyperparameter calibrations. [Figure 5A] This is a plot of the accuracy of the neural network training and validation datasets against the batch size of a batch training example. [Figure 5B] This is a plot of the accuracy of the training and validation datasets of the neural network against the augmented diversity of the training examples. [Modes for carrying out the invention]

[0056] Similar reference numbers and designations in various drawings refer to the same elements.

[0057] Machine learning models (e.g., neural network models) trained using standard pipelines (for example, in the absence of privacy-sensitive training techniques) can be attacked by attackers who seek to expose the training data (e.g., individual training examples) on which the model was trained. However, privacy-sensitive training of neural networks—that is, training to mitigate privacy attacks against them by attackers—is a considerable challenge. Currently available techniques can lead to significant degradation of neural network performance on standard machine learning tasks, such as image classification benchmarks. Furthermore, currently available techniques for privacy protection are generally inadequate for large-scale neural network models (e.g., large-scale language models), and it is taken for granted that such results may be inevitable for large-scale models.

[0058] The training systems described herein address some or all of these problems. For example, the training systems can provide privacy to overly parameterized large neural network models while maintaining high performance of the neural network on various machine learning tasks, for instance, by using data augmentation, noise injection, and hyperparameter calibration techniques. The training systems may be able to provide performance for privately trained neural networks that is similar to the performance achieved by non-privately trained neural networks.

[0059] These and other features are described in more detail below.

[0060] Figure 1 shows an exemplary training system 100 capable of performing privacy-sensitive training of a neural network 110. The training system 100 is an example of a system implemented as a computer program on one or more computers in one or more locations where the systems, components, and techniques described below are implemented.

[0061] The neural network 110 is parameterized by a set of network parameters 112 and configured to process network inputs to generate network outputs. The training system 100 can train the neural network 110 on the training dataset 120 to perform a machine learning task while simultaneously providing privacy protection to the training dataset 120.

[0062] The privacy-sensitive training performed by the training system 100 on the neural network 110 can be understood as the privatization learning algorithm A:D→S. Generally, the privatization learning algorithm A takes a set of training data D∈D120 as input and the neural network parameters of the neural network 110.

[0063]

number

[0064] This is a randomized learning algorithm that generates a set of 112 outputs. For example, the set of neural network parameters 112 may include the weights (and biases) of multiple neural network layers of the neural network 110, such as the weights of one or more feedforward neural network layers, the convolutional weights of one or more convolutional neural network layers, the parameter matrices and parameter vectors of one or more recurrent neural network layers, and so on.

[0065] The privacy protection provided by a privatization learning algorithm is analogous to one-way encryption that implements a one-way function, such as for secret-key cryptography or cryptographic hashing. A one-way function is a function that is relatively easy to compute for any input but relatively difficult to reverse given an output with a random input, where "easy" and "difficult" refer to computational complexity. A privatization learning algorithm may be understood in a similar sense. As described below, it is relatively easy to run a privatization learning algorithm on a set of training data 120 to generate a set of network parameters 112. However, given a set of network parameters 112, extracting a single training example 122 from the training dataset 120 is relatively difficult (or impossible), even if an attacker has complete knowledge of the privatization learning algorithm. Thus, a privatization learning algorithm provides a means of "encrypting" the training dataset 120 used to train the neural network 110.

[0066] In this case, the set of network parameters 112 is represented as a vector for ease of explanation, where p is the model size (or model dimension) and corresponds to the total number of learnable network parameters 112. The training system 100 can perform privacy-sensitive training for neural networks 110 with any number of network parameters 112. For example, the model size is 10 5 More than 10 pieces 6 More than 10 pieces 7 More than 10 pieces 8 More than 10 pieces 9 More than 10 pieces 10 More than 10 pieces 11 More than 10 pieces 12 There may be more than one.

[0067] Training dataset

[0068]

number

[0069] consists of a total of N training examples d i 122, where N corresponds to the size of the training dataset 120. The training system 100 can use any sized training dataset 120 to train the neural network 110. For example, the training dataset 120 can include 10 or more training examples, 10 2 or more training examples, 10 3 or more training examples, 10 4 or more training examples, 10 5 or more training examples, 10 6 or more training examples, 10 7 or more training examples, 10 8 or more training examples, 10 9 or more training examples, 10 10 or more training examples.

[0070] The training dataset 120 may be a private dataset, for example, a dataset containing private information (e.g., personal information, non-public information, and / or confidential information) for which the training system 100 aims to provide privacy. That is, the training system 100 attempts to mitigate the risk of privacy attacks against the neural network 110, such as an attempt to extract from the neural network 110 one or more training examples 122 (or other individualized information) contained in the training dataset 120 for which the neural network 110 is trained. For example, to prevent such attacks, the training system 100 can establish network parameters 112 that are not strongly correlated with any individual training example 122 by training the neural network 110 with respect to a batch 121 of training examples that have data augmented, noise injected, and / or gradients clipped to a clipping threshold. With that in mind, each training example 122 may include data relating to a specific person, such as images, videos, and / or audio of that person, text written by that person, or their electronic medical records, which that person may not want to be made public.

[0071] In some implementations, the neural network 110 may be a pre-trained neural network. For example, the network parameters 112 of the neural network 110 may be pre-trained on a non-private (e.g., public) training dataset using a non-privacy-sensitive training technique. The training system 100 can then fine-tune the network parameters 112 of the neural network 110 against the private training dataset 120 to provide privacy protection to the private training dataset 120. These implementations may be advantageous, for example, for incorporating sensitive data into an existing neural network model to fine-tune a large-scale language model.

[0072] In some implementations, the privatization learning algorithm A performed by the training system 100 is a differentially private (DP) learning algorithm. In these cases, the DP learning algorithm provides a formal privacy guarantee to the trained neural network 110. More specifically, the training system 100 can perform the DP learning algorithm to prevent an attacker observing the output of computations performed by the trained neural network 110 from inferring any properties relating to individual training examples 122 in the training dataset 120 used during training. The strength of this privacy guarantee is generally controlled by two parameters ε>0 and δ∈[0,1], collectively called the privacy budget (ε,δ). Roughly speaking, ε defines the boundary of the log-likelihood ratio of any particular set of network parameters 112 that can be obtained when the training system 100 performs the DP learning algorithm on two different datasets in a single training example, and δ is a small probability that defines the boundary of occurrence of a low-frequency set of network parameters 112 that violates this boundary. As both the ε and δ parameters become smaller, the privacy guarantee becomes stronger. The training system 100 can aim to make ε a small constant and δ smaller than 1 / N, where N is the size of the training dataset 120.

[0073] More formally, for any two adjacent training datasets D, D' ∈ D that differ only by a single training example 122, the DP learning algorithm is

[0074]

number

[0075] If the following conditions are met, the DP learning algorithm A implemented by the training system 100 is (ε,δ)-DP, where probability

[0076]

number

[0077] The randomness of the DP learning algorithm A is inherited. When ε and δ are small, changes in network parameters 112 due to a single substitution in the training dataset 120 can be ignored, and thus privacy is protected. The training system 100 can train the neural network 110 for high performance under a strict privacy budget, i.e., when both ε and δ are relatively small. For example, ε may be less than 1, ε may be less than 2, ε may be less than 3, ε may be less than 4, ε may be less than 5, ε may be less than 6, ε may be less than 7, ε may be less than 8, ε may be less than 9, and ε may be less than 10. At the same time, depending on the size N of the training dataset 120, δ may be 10 -10 It may be smaller than δ, and δ is 10 -9 It may be smaller than δ, and δ is 10 -8 It may be smaller than δ, and δ is 10 -7 It may be smaller than δ, and δ is 10 -6 It may be smaller than δ, and δ is 10 -5 It may be smaller than δ, and δ is 10 -4 It may be smaller than δ, and δ is 10 -3 It may be smaller than δ, and δ is 10 -2 It may be smaller than δ, and δ is 10 -1 It can be smaller than that.

[0078] The privacy protection provided by the DP learning algorithm rests under an extremely robust threat model, namely, inferences about individual training examples 122 are protected against an attacker with complete knowledge of the DP learning algorithm, unlimited computational power, and arbitrary secondary knowledge of the training dataset 120. Furthermore, the DP learning algorithm satisfies several advantageous properties, including maintenance under post-processing and smooth degradation associated with multiple accesses to the same training dataset 120. These properties can be leveraged by the training system 100 to construct the DP learning algorithm based on a combination of small building blocks that inject data augmentation and noise into the operation of accessing the training dataset 120. Such and other features are described in more detail below.

[0079] As shown in Figure 1, the privatized learning algorithm A is an iterative algorithm in which the training system 100 is executed sequentially for each of multiple training iterations t=1, 2, ..., T in order to optimize the objective function L140. In detail, the training system 100 adjusts the network parameters w in each training iteration (t) according to the privatized update rule (see example below) in order to gradually minimize (or maximize) the objective function 140 with respect to the network parameters w (t)The value of 112.t is updated. The training system 100 can implement a privatization update rule in each training iteration to generate a set of network parameters 112 that are not strongly correlated with any individual training example 122 and therefore provide privacy. However, such decorrelation may result in a "privacy cost" in each training iteration, i.e., a loss of performance of the neural network 110 due to masking of training examples 122, for example, data augmentation, injected noise, and / or gradients clipped to a clipping threshold. Therefore, in some implementations, the training system 100 aims to reduce the number of training iterations involved in optimizing the objective function 140, which can improve the performance of the neural network 110. For example, the training system 100 may reduce the number of training iterations to 10, for example, more than what might otherwise be required to reach an acceptable level of performance (e.g., prediction accuracy). 2 Less than 10 training iterations 3 Less than 10 training iterations 4 Less than 10 training iterations 5 The training iteration can be performed up to a certain number of times.

[0080] The objective function 140 can be any suitable objective function that measures the performance of the neural network 110 on a machine learning task. For example, the objective function may include a cross-entropy loss term, a divergence loss term, a mean squared error (MSE) loss term, or any other suitable loss term.

[0081] The detailed steps of each training iteration t=[1,T] proceed as follows:

[0082] The training system 100 uses training dataset B t Sample batch 121 of training examples from ⊂D. The number of training examples 122.i in batch 121 is the batch size B. t =|B t| may be the same or different between each training iteration. For example, a particular batch 121 of training examples may contain one or more training examples, five or more training examples, ten or more training examples, 100 or more training examples, 1000 or more training examples, 5000 or more training examples, or 10000 or more training examples. The relative size of batch 121 to the size of the training dataset 120 is the sampling ratio q for the training iteration. t =B t It is called / N.

[0083] Batch i∈B t Each training example 122.i within this example uses network input x i Includes 124.i. Training example 122.i also shows, for example, when the training system 100 implements a supervised learning algorithm to train the neural network 110, the corresponding network input 124.i is d i =(x i ,y i A target output y that is labeled as ) i 126.i may be included. For example, if the neural network 110 is a discriminative neural network, the network input 124.i may include images, videos, and / or audio, and the target output 126.i may include a text sequence. Conversely, if the neural network 110 is a generative neural network, the network input 124.i may include a text sequence, and the target output 126.i may include images, videos, and / or audio.

[0084] In some implementations, training example 122.i also has a corresponding network input 124.i. i =x iIt is not possible to include a target output 126.i that is not labeled. In these implementations, for example, if the objective function 140 includes an expected return, e.g., an expected discounted sum of rewards, or a contrasting loss term, the training system 100 may implement an unsupervised learning algorithm or a reinforcement learning algorithm to train the neural network 110. In general, the training example 122.i can include both labeled and / or unlabeled network inputs, and the objective function 140 can include any appropriate loss term. In some cases, the network input can include multiple types of data (e.g., multimodal data).

[0085] For each network input 124.i in batch 121, the training system 100 applies at least one extended transformation ψ for the network input 124.i. jObtain 130.j. In some implementations, the training system 100 may randomly sample multiple extended transformations 130.j, for example, by sampling from a probability distribution via the extended transformation. In some implementations, the training system 100 may randomly sample the parameters defining each of the extended transformations 130.j, for example, by sampling from the respective probability distributions via such parameters. As an example, if the network input 124.i contains an image, the extended transformation 130.j may include trimming, coloring, noising, translation, rotation, scaling, shearing, reflection, and / or projection of the image. Parameters defining such an extended transformation 130.j may include trimming size, coloring color and coloring luminance, noise dispersion, displacement vector, rotation angle, scale factor, shear angle, reflection angle, and / or basis vectors. As another example, if the network input 124.i contains audio data, the extended transformation 130.j may include adding noise, adding reverberation effects, adding microphone effects, and so on. The parameters defining such an extended transformation 130.j may include noise dispersion, reverberation time, speech modulation pitch, etc. Depending on the implementation, the extended transformation 130.j may include linear and / or nonlinear transformations (e.g., nonlinear functions) (e.g., representable as matrices). In some cases, a nonlinear extended transformation 130.j may be associated with each neural network.

[0086] The training system 100 applies each of the extended transformations 130.j to the network input 124.j. The application of extended transformations 130.j is the extended version of each network input.

[0087]

number

[0088] Generate 134.j. Number of extended network inputs.

[0089]

number

[0090] This is called augmentation diversity. Augmentation diversity may be the same or different between each network input 124.i in batch 121 and / or between each training iteration. For example, a particular augmentation diversity may be 1 or greater, 2 or greater, 5 or greater, 10 or greater, 20 or greater, 50 or greater, 100 or greater, 250 or greater, or 500 or greater. The training system 100 can perform data augmentation of network input 124.i to varying degrees to improve the performance of the neural network 110, which may be particularly advantageous in large (e.g., over-parameterized) neural network models to reduce the possibility of overfitting.

[0091] The training system 100 outputs each network output for the extended network input 134.j

[0092]

number

[0093] To generate 136.j, the current value of the network parameter w (t) According to 122.t, each augmented network input is processed using neural network 110.

[0094]

number

[0095] This process is performed by the neural network 110, and the function f is parameterized by the network parameters 112.t according to their current values ​​in the training iteration (t). w (t) It can be expressed as follows.

[0096]

number

[0097] The training system 100 then measures each performance metric l for the extended network input 134.j. j To generate 140.j, the objective function 140 is used to evaluate the network output 136.j associated with each augmented network input 134.j. The performance metric 140.j for an augmented network input 134.j generally depends on whether the corresponding network input 124.i is labeled or unlabeled, i.e., whether it has a target output 126.i. For example, the performance metric 140.j may characterize the error or likelihood between the network output 136.j and the associated target output 126.i.

[0098]

number

[0099] The training system 100 calculates the gradient g for each extended network input 134.j by differentiating its performance measure 140.j with respect to the neural network parameters 112. j Determine 142.j.

[0100]

number

[0101] However, ∇=∂ / ∂w represents the gradient operator with respect to the neural network parameter 112. For example, the training system 100 can use backpropagation to determine the gradient 142.j for each augmented network input 134.j. Generally, the gradient 142.j represents how sensitive the performance 140.j of each augmented network input 134.j is to the current value of the network parameter 112.t. For example, the gradient 142.j of an augmented network input 134.j with a relatively small norm may imply that its performance 140.j is not very sensitive to the current value of the network parameter 112.t, and vice versa if the gradient 142.j has a relatively large norm.

[0102] The training system 100 combines the gradients G of the extended version 134.j associated with each network input 124.i by combining them. i Determine 144.i. For example, training system 100,

[0103]

number

[0104] The gradient 142.j can be linearly combined as follows, where Σ j k j =1 and k j k is the coefficient for each gradient 142.j in the linear combination in equation (5). The training system 100 then selects appropriate coefficients k, for example, to either emphasize or not emphasize the augmented network input 134.j. j The gradient 142.j can be appropriately weighted for each augmented network input 134.j using this method. In some implementations, the coefficient k j This may correspond to the probabilities or scores of the probability distribution. In some implementations, the training system 100 weights each coefficient equally to the gradient 142.j of each extended version 134.j.

[0105]

number

[0106] Alternatively, we could average the gradient 142.j to achieve the result shown.

[0107] The training system 100 clips the connected gradient 144.i for each network input 124.i, thereby obtaining the clipped gradient C for each network input 124.i. i Determine 146.i. C i (w (t) )=clip C (G i (w (t) )) (5)

[0108] Clipping function (clip C ) clips the joint gradient 144.i to the maximum norm defined by the clipping threshold C. The norm is, in some cases, the L2 norm, L n It can be a norm, or another appropriate norm. Roughly speaking, the clipping threshold determines the maximum effect that any one network input 124.i in batch 121 can perform when the training system 100 updates the network parameter 112 such that the network parameter 112 is not strongly biased in progress by any particular network input 124.i. In some implementations, the clipping threshold can be about 1 or less, about 2 or less, about 3 or less, about 4 or less, about 5 or less, about 6 or less, about 7 or less, about 8 or less, about 9 or less, or about 10 or less.

[0109] The training system 100 can perform hard clipping such that the norm of the joined gradient 144.i is clipped to a clipping threshold C along a piecewise and linear curve. The training system 100 can also perform soft clipping such that the norm of the joined gradient 144.i is clipped to a clipping threshold C along a smooth curve. As an example of hard clipping, the clipping function rescales its input such that its output has a maximum L2 norm of C.

[0110]

number

[0111] It can be expressed as follows. In some implementations, soft clipping may be more advantageous than hard clipping (for example, for quadratic optimization techniques) because the clipped gradient 146.i is generally differentiable with respect to the network parameter 112.

[0112] The training system 100 generates a set of noise parameters z151 by randomly sampling noise parameters 151 from the noise distribution P(z)150. In some implementations, the noise distribution 150 is a Gaussian (normal) distribution P(z)=N(z;μ,Σ) with corresponding mean μ and variance Σ. In some further implementations, the Gaussian distribution is Σ=σ 2 It is a spherical Gaussian distribution with a mean of 0 such that I and μ=0, where σ is the standard deviation. However, generally, the noise distribution 150 can be any desirable noise (or probability) distribution, in particular, the speckle distribution, Poisson distribution, Rayleigh distribution, or beta distribution.

[0113] The training system 100 then applies the noise parameter 151 to the clipped gradient 146.i. For example, the training system 100 can linearly combine the clipped gradient 146.i with the noise parameter 151 to generate a privatized gradient F for the training iteration (t).

[0114]

number

[0115] However, Σ i b i =1 and b i is the coefficient for each clipped gradient 146.i in the linear combination in equation (7). The training system 100 can, for example, adjust the coefficient b to give more or less privacy to some training examples 122.i in batch 121. i The clipped gradient 146.i for each network input 124.i can be appropriately weighted using the coefficient b. i This may correspond to the probability or score of a probability distribution. In some implementations, the training system 100 weights each network input 124.i and the clipped gradient 146.i equally, with each coefficient being b i =( B t ) -1 The clipped gradient 146.i may be averaged. The privatized gradient in equation (7) provides privacy to the training example 122.i, since the additional noise z, proportional to the clipping threshold C, is generally sufficient to mask the contribution of any training example 122.i whose clipped gradient 146.i has a norm less than or equal to C.

[0116] In some implementations, the training system 100 goes from F to C -1 C such that F -1Normalize the privatized gradient F by such a coefficient. In these cases, the magnitude of the clipping threshold C does not affect the scale of the privatized update rule, which can simplify hyperparameter calibration (described in more detail below).

[0117] The training system 100 uses the clipped gradient 146.i to update the neural network parameter w for the training iteration (t). (t+1) 122.(t + 1). For example, the training system 100 w (t+1) = w (t) -η t F(w (t) ) (8) To establish a privatized update rule of the form, a first-order optimization technique can be implemented using the privatized gradient, where η t is the learning rate (or step size) for the training iteration. The learning rate may be the same or different between training iterations. For example, the training system 100 can use a constant learning rate for each training iteration, for example, η < 1 where η t = η, or, for example, η < 1 where η t = η t to decay the learning rate for each training iteration. The privatized update rule of equation (8) is a type of stochastic gradient descent (SGD) method, but the training system 100 can use a similar privatized update rule in combination with other first-order optimization techniques such as SGD with momentum or Adam.

[0118] As another example, the training system 100 w (t+1) = w (t) -H -1 (w (t) )·F(w (t) ) (9) To establish a privatization update rule of the form H = ∇F, a quadratic optimization technique can be performed using the privatization gradient, where H is the Hessian matrix. The training system 100 can determine the Hessian matrix by calculating the gradient of the privatization gradient H = ∇F, where ∇ = ∂ / ∂w represents the gradient operator with respect to the neural network parameters 112. For example, the training system 100 can use backpropagation to determine the Hessian matrix.

[0119] The training system 100 then initializes the neural network 110 with the updated neural network parameters 112.(t+1), and repeats the above process for the next training iteration (t+1) to decide on another private update to the network parameters 112, and so on.

[0120] As described above, the training system 100 performs data augmentation during privacy-sensitive training of the neural network 110. Data augmentation, typically performed in non-private training, using one augmentation per independent training example 122.i within each batch 121, can reduce both training and validation accuracy, for example, because such data augmentation introduces variability into the gradient, thereby increasing the number of training iterations required. Using multiple augmentations 134.j per training example 122.i, as described above, can allow the training system 100 to reap the benefits of data augmentation in privacy-sensitive training. One technique for performing multiple augmentations per training example 122.i would be to calculate one clipped gradient for each augmented network input 134.j. However, this would lead to the privacy cost scaling with the number of augmentations 134.j per network input 124.i for training example 122.i. The training system 100 addresses this problem by combining the gradients 142.j of different extensions 134.j of the same network input 124.i into a combined gradient 144.i before clipping. In this way, the training system 100 does not increase the sensitivity of batch gradients to any single training example 122.i and therefore incurs no additional privacy costs.

[0121] The training system 100 may repeat this iterative process described above until one or more conditions are met. For example, one or more conditions may include the training system 100 reaching a predetermined number of training iterations t=T, such as determined by hyperparameter calibration. As another example, one or more conditions may include the objective function 140 evaluated with respect to the network output 136.j being, for example, Σ ij b i k j l j (w (t)) may include being less than (or greater than) a threshold value a1 such that it is not equal to a1. As another example, one or more conditions are such that an objective function 140 evaluated for the network output 136.j, for example, |Σ ij b i k j l j (w (t) ) - Σ ij b i k j l j (w (t-1) )| < a2, and may include changing a relatively negligible threshold value a2 with consecutive training iterations.

[0122] Note that the performance of the neural network 110 is generally affected by combinations of multiple hyperparameters implemented by the training system 100 over the entire training. Such hyperparameters include, but are not limited to, in particular, the number of training iterations T, the sampling ratio q t , expansion diversity

[0123]

Number

[0124] , the clipping threshold C, the mean and variance of the noise distribution 150, the learning rate η tThis includes additional practical constraints that the training system 100 may also take into account, such as the maximum computed budget available to train the neural network 110 on specific computing hardware. The training system 100 may calibrate one or more of these hyperparameters to adapt to the best possible performance for the neural network 110 while ensuring privacy protection for the training dataset 120. For example, the training system 100 may train multiple instances of the neural network 110 with different values ​​for the hyperparameters under a given computed budget, and then select the best-performing neural network 110 from among the multiple instances.

[0125] If the training system 100 implements a DP learning algorithm, the privacy budget (ε,δ) for the DP learning algorithm may be fixed, for example, by defining a specific target privacy protection for the training dataset 120. In these cases, the training system 100 can calibrate one or more of the hyperparameters within this privacy budget. The training system 100 can perform such a calibration process using a privacy accountant, i.e., a numerical algorithm that gives an upper limit for the privacy budget as a function of the hyperparameters. Considerations of a privacy accountant for differential privacy are provided in Abadi, Martin et al., "Deep learning with differential privacy," minutes of the 2016 ACM SIGSAC conference on computer and communications security (2016). Given a privacy budget and then one or more other hyperparameters (e.g., sampling ratio, expansion diversity, learning rate), the training system 100 can combine a privacy accountant with an optimization routine to optimize one hyperparameter (e.g., the number of training iterations). Examples of such optimization routines are described below with respect to Figures 4, 5A, and 5B.

[0126] In some implementations, the training system 100 performs parameter averaging on the set of network parameters 112 of the neural network 110. For example, in some training iterations, the training system 100 may set the value of each (trained) network parameter of the neural network 110 to equal the moving average (e.g., exponential moving average) of the network parameter values ​​for the duration of the preceding training iteration window. Parameter averaging can help reduce oscillations in network parameter values ​​during training and improve accuracy.

[0127] In some implementations, the training system 100 applies weight standardization to one or more neural network layers of the neural network 110 in each of one or more training iterations. For example, the training system 100 may apply weight standardization to each convolutional layer of the neural network 110. Weight standardization of a neural network layer may include, for example, normalizing the parameter values ​​of the neural network layer to improve stability during training. For example, the training system 100 may apply weight standardization to a convolutional neural network layer by normalizing the rows of the weight matrix for each convolution across the fan-in of each output unit.

[0128] Figure 2 is a flowchart of an exemplary process 200 for privacy-sensitive training of a neural network. For convenience, process 200 is described as being performed by a system of one or more computers located in one or more locations. For example, a training system appropriately programmed according to this specification, e.g., training system 100 in Figure 1, can perform process 200.

[0129] The training system trains a set of network parameters for a neural network on a set of training data over multiple training iterations to optimize the objective function (210). In some implementations, the objective function includes a classification loss.

[0130] For each training iteration, the training system executes steps 220-260.

[0131] The training system samples batches of network inputs from the training data set (220). In some implementations, each training iteration contains at least 4000 network inputs.

[0132] The training system determines the clipped gradient for each network input in a batch of network inputs (230). An exemplary process for determining the clipped gradient for network inputs is described in more detail below with reference to Figure 3.

[0133] The training system generates a set of noise parameters, which includes randomly sampling noise parameters from a noise distribution (240). In some implementations, the noise distribution includes a Gaussian noise distribution.

[0134] The training system applies a noise parameter (250) to the clipped gradients of the network inputs within a batch of network inputs.

[0135] The training system updates the neural network parameters using the clipped gradients to the network inputs within a batch of network inputs (260).

[0136] Figure 3 is a flowchart of an exemplary process 230 for determining the clipped gradient to the network input to a neural network. For convenience, process 230 is described as being performed by a system of one or more computers located in one or more locations. For example, a training system appropriately programmed according to this specification, e.g., training system 100 in Figure 1, can perform process 230.

[0137] The training system generates multiple extended versions of the network input, where each extended version of the network input is obtained by the training system applying its respective extended transformation to the network input (310). In some implementations, the training system generates at least eight extended versions of the network input.

[0138] For each extended version of the network input, the training system performs steps 320-330.

[0139] The training system uses the neural network to process an augmented version of the network input according to the current values ​​of the neural network parameters of the neural network in order to generate the corresponding network output (320).

[0140] The training system determines the gradient of the objective function with respect to the neural network parameters of the neural network when the objective function is evaluated with respect to the network output (330).

[0141] The training system determines the coupled gradient to the network input by combining the gradients determined for multiple extended versions of the network input (340). In some implementations, the training system determines the coupled gradient to the network input by averaging the gradients determined for multiple extended versions of the network input.

[0142] The training system generates clipped gradients to the network inputs by clipping the connection gradients to the network inputs (350). In some implementations, for one or more of the network inputs, the training system generates clipped gradients to the network inputs by scaling the connection gradients to the network inputs to satisfy a clipping threshold to the norm of the connection gradients to the network inputs. In some implementations, the training system scales the connection gradients to the network inputs by a scaling factor defined as the ratio of (i) the clipping threshold to (ii) the norm of the connection gradients to the network inputs.

[0143] Figures 4, 5A, and 5B show experimental results of training system 100 using various hyperparameter calibration techniques to optimize the performance of a Wide-ResNet neural network model with privacy-sensitive training. These techniques include replacing batch normalization with group normalization using large batch sizes, convolutional layer weight normalization, data augmentation, and parameter averaging. For the experiments in Figures 4, 5A, and 5B, training system 100 uses the CIFAR-10 training dataset to train and validate the neural network. In detail, for training and validation, training system 100 splits the CIFAR-10 dataset of 50K examples into a training dataset of 45K training examples and a validation dataset of 5K validation examples. Training system 100 uses (8,10 -5 Under DP, a DP learning algorithm is used to train the neural network over multiple training passes on this reduced training set.

[0144] Figure 4 is a table of the training and validation dataset accuracy of the Wide-ResNet neural network model (WRN-40-4) under various hyperparameter calibrations. The table reports the median and standard deviation across five independent training iterations for each additional hyperparameter calibration. The baseline model was trained with no batch normalization, no data augmentation, and a batch size of 256 per training iteration. As can be seen from the table, variations in hyperparameters, such as increasing the batch size, and augmentation diversity result in (8,10) -5 )- Significantly improves the performance of neural networks under DP.

[0145] Figure 5A shows plots of the training and validation dataset accuracy of the Wide-ResNet neural network model (WRN-16-4) against the batch size of the training example batch. The mean and standard errors of the training and validation dataset accuracy are plotted in Figure 5A across five independent training cycles for each batch size. As seen in Figure 5A, increasing the batch size (8, 10) -5 )- Under DP, this leads to improved performance of neural networks.

[0146] Figure 5B shows plots of the training and validation dataset accuracy of the Wide-ResNet neural network model (WRN-16-4) against the augmentation diversity of the training examples. The mean and standard errors of the training and validation dataset accuracy are plotted in Figure 5B across five independent training cycles for each augmentation diversity. As seen in Figure 5B, increasing the augmentation diversity results in (8,10 -5 )- Under DP, this leads to improved performance of neural networks.

[0147] This specification uses the term “configured” with respect to system and computer program components. One or more computer systems are configured to perform a particular operation or action to mean that the system has installed software, firmware, hardware, or a combination thereof on it that causes the system to perform that operation or action. One or more computer programs are configured to perform a particular operation or action to mean that one or more programs contain instructions that, when executed by a data processing device, cause the device to perform that operation or action.

[0148] The subject matter and functional embodiments described herein may be implemented in digital electronic circuit configurations, tangibly embodied computer software or firmware, computer hardware, or in one or more combinations thereof, including the structures disclosed herein and their structural equivalents. Embodiments of the subject matter described herein may be implemented as one or more modules of computer programs, i.e., computer program instructions encoded on a tangible non-temporary storage medium for execution by a data processing device or for controlling the operation of a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage board, a random-access memory device or a serial-access memory device, or one or more combinations thereof. Alternatively or additionally, the program instructions may be encoded on artificially generated propagating signals, such as machine-generated electrical signals, optical signals or electromagnetic signals, which are generated to encode information for transmission to a suitable receiver device for execution by a data processing device.

[0149] The term "data processing device" refers to data processing hardware and encompasses all types of devices, machines, and equipment for processing data, including, for example, programmable processors, computers, or multiple processors or computers. A device may also be a dedicated logic circuit configuration, such as an FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit), or may further include these. In addition to hardware, a device may optionally include code that creates an execution environment for computer programs, such as processor firmware, protocol stacks, database management systems, operating systems, or code that constitutes one or more of these.

[0150] Computer programs, sometimes called or described as programs, software, software applications, apps, modules, software modules, scripts, or code, can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and can be deployed in any form, including as standalone programs or as modules, components, subroutines, or other units suitable for use in a computing environment. A program may, but is not required, correspond to a file in a file system. A program may be stored in a part of a file that holds one or more scripts stored in other programs or data, such as a markup language document, in a single file dedicated to the program, or in multiple collaborative files, such as files that store one or more modules, subprograms, or parts of code. A computer program may be deployed to run on one computer, located in one site, or on multiple computers distributed across multiple sites and interconnected by a data communication network.

[0151] In this specification, the term “engine” is used broadly to refer to a software-based system, subsystem, or process programmed to perform one or more specific functions. Generally, an engine is implemented as one or more software modules or software components installed on one or more computers in one or more locations. In some cases, one or more computers are dedicated to a particular engine, while in other cases, multiple engines may be installed and running on one or more of the same computers.

[0152] The processes and logic flows described herein may be executed by one or more programmable computers running one or more computer programs that perform functions by acting on input data and generating outputs. The processes and logic flows may also be executed by dedicated logic circuit configurations, such as FPGAs or ASICs, or by a combination of dedicated logic circuit configurations and one or more programmed computers.

[0153] A computer suitable for running computer programs can be based on a general-purpose microprocessor, a dedicated microprocessor, or both, or any other type of central processing unit. Generally, the central processing unit receives instructions and data from read-only memory, random-access memory, or both. Essential elements of a computer are a central processing unit for performing or executing instructions, and one or more memory devices for storing instructions and data. The central processing unit and memory can be augmented by or incorporated into a dedicated logic circuit configuration. Generally, a computer also includes one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or is operablely coupled to them to receive data from or transfer data to or both. However, it is not essential for a computer to have such devices. Furthermore, computers can be integrated into other devices, such as mobile phones, personal digital assistants (PDAs), mobile audio or video players, game consoles, GPS receivers, or portable storage devices, such as Universal Serial Bus (USB) flash drives.

[0154] Computer-readable media suitable for storing computer program instructions and data include, for example, all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.

[0155] To interact with a user, embodiments of the subject matter described herein may be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and pointing device, such as a mouse or trackball, by which the user can provide input to the computer. Other types of devices may also be used to interact with the user, for example, the feedback provided to the user may be any form of perceptual feedback, such as visual feedback, auditory feedback, or tactile feedback, and input from the user may be received in any form, including acoustic input, voice input, or tactile input. In addition, the computer may interact with the user by sending documents to and receiving documents from devices used by the user, for example, by sending a web page to a web browser on the user's device in response to a request received from a web browser. The computer may also interact with the user by sending text messages or other forms of messages to a personal device, such as a smartphone running a messaging application, and receiving response messages from the user in return.

[0156] Data processing devices for implementing machine learning models may also include, for example, dedicated hardware accelerator units for handling the general and computationally intensive parts of the machine learning training or manufacturing process, i.e., inference.

[0157] Machine learning models can be implemented and deployed using machine learning frameworks, such as TensorFlow or Haiku.

[0158] Embodiments of the subject matter described herein may be implemented in a computing system that includes, for example, a data server, a backend component, or a middleware component, such as an application server, or a frontend component, such as a client computer having a graphical user interface, a web browser, or an application through which a user can interact with the implementation of the subject matter described herein, or any combination of one or more such backend components, middleware components, or frontend components. The components of the system may be interconnected by digital data communications of any form or medium, such as communication networks. Examples of communication networks include local area networks (LANs) and wide area networks (WANs), such as the Internet.

[0159] A computing system can include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship between a client and a server arises when computer programs run on each computer and have a client-server relationship with each other. In some embodiments, the server sends data, such as an HTML page, to a user device for the purpose of displaying data to a user interacting with a device acting as a client and receiving user input from such a user. Data generated on the user device, such as the results of user interaction, may be received from the device by the server.

[0160] This specification includes many specific implementation details, which should not be construed as limitations on the scope of any invention or claim, but rather as descriptions of features that may be specific to a particular embodiment of a particular invention. Some features described herein in the context of separate embodiments may also be implemented in combination within a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented separately or in any preferred partial combination within multiple embodiments. Furthermore, features may be described above as working in several combinations, and may even be initially claimed as such, but one or more features from a claimed combination may, in some cases, be removed from that combination, and the claimed combination may cover a partial combination or a variation of a partial combination.

[0161] Similarly, while the operations are illustrated in the drawings in a specific order and described in the claims, this should not be understood as requiring that such operations be performed in a specific or sequential order as illustrated, or that all illustrated operations be performed, in order to achieve the desired result. In some environments, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged in multiple software products.

[0162] Specific embodiments of this subject matter are described. Other embodiments fall within the scope of the following claims. For example, the actions described in the claims may be performed in a different order and still achieve the desired results. As an example, the process shown in the accompanying drawings does not necessarily require the specific order or sequence shown to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. [Explanation of Symbols]

[0163] 100 training systems 110 Neural Networks 112 Network Parameters 120 training datasets 121 training example batches 122 Training Examples 124 Network Inputs 126 Target Output 130 Extended Conversion 134 Extended Network Input 136 Network Outputs 140. Objective function, performance measure 142 gradient 144 Coupling gradient 146 clipped gradients 150 Noise Distribution 151 Noise Parameters

Claims

1. A method performed by one or more computers for privacy-sensitive training of a neural network, The method includes a step of training a set of neural network parameters for the neural network on a set of training data over multiple training iterations in order to optimize the objective function, wherein the training step is performed in each training iteration, The steps include sampling multiple network inputs from the aforementioned training data set, For each of the network inputs of the plurality of network inputs, A step of generating multiple extended versions of the network input, wherein each extended version of the network input is obtained by applying its respective extended transformation to the network input, When the objective function is evaluated for the network output generated by the neural network by processing the extended version of the network input, the steps include determining the gradient of the objective function with respect to the neural network parameters of the neural network for each of the multiple extended versions of the network input, A step of determining a coupled gradient to the network input by combining the gradients determined for the multiple extended versions of the network input, and A step of generating a clipped gradient to a network input by clipping the coupling gradient to the network input, comprising scaling the coupling gradient such that the norm of the coupling gradient satisfies a clipping threshold, The steps include determining the clipped gradient for each of the plurality of network inputs, A step of updating the neural network parameters using the clipped gradients of the plurality of network inputs with respect to the network inputs. A method that includes [a certain feature].

2. The step of generating the multiple extended versions of the network input is: For each extended transformation, the process includes the step of randomly sampling the parameters that define the extended transformation, and the step of obtaining multiple extended transformations, The steps include: generating each extended version of the network input by applying each extended transformation to the network input; The method according to claim 1, comprising:

3. The step of determining the gradient of the objective function with respect to the extended version of the network input is: The steps include: processing the extended version of the network input using the neural network according to the current values ​​of the neural network parameters of the neural network in order to generate a corresponding network output; When the objective function is evaluated with respect to the network output, the steps include determining the gradient of the objective function with respect to the neural network parameters of the neural network, and The method according to claim 1, comprising:

4. The step of determining the coupling gradient for the network input is, A step of averaging the gradients determined for the multiple extended versions of the network input. The method according to claim 1, comprising:

5. The step of scaling the coupling gradient to the network input such that the norm of the coupling gradient to the network input satisfies the clipping threshold is (i) scaling the coupling gradient to the network input by a scaling factor defined as the ratio of the clipping threshold and (ii) the norm of the coupling gradient to the network input. The method according to claim 1, comprising:

6. Before updating the neural network parameters using the clipped gradients of the plurality of network inputs relative to the network inputs, A step of generating a set of noise parameters, comprising the step of randomly sampling noise parameters from a noise distribution, The steps of applying the noise parameter to the clipped gradient of the plurality of network inputs with respect to the network inputs: The method according to claim 1, further comprising:

7. The method according to claim 6, wherein the noise distribution comprises a Gaussian noise distribution.

8. The method according to claim 1, wherein the neural network does not include any batch normalization layer.

9. The method according to claim 1, wherein the neural network includes a group normalization layer.

10. The method according to claim 1, wherein the neural network is configured to process a network input comprising an image.

11. The method according to claim 1, wherein the neural network is configured to process a network input comprising audio data.

12. The method according to claim 1, wherein the neural network is configured to process a network input comprising electronic medical record data.

13. The method according to claim 1, wherein the neural network is configured to process a network input comprising text data.

14. The method according to claim 1, wherein the neural network comprises one or more convolutional neural network layers.

15. The method according to claim 1, wherein the objective function comprises a classification loss.

16. The method according to claim 1, wherein in each training iteration, the plurality of network inputs comprises at least 4,000 network inputs.

17. The method according to claim 1, wherein the step of generating a plurality of extended versions of the network input comprises the step of generating at least eight extended versions of the network input.

18. One or more computer-readable storage media that store instructions causing one or more computers to perform the method according to any one of claims 1 to 17 when executed by one or more computers.

19. It is a system, One or more computers, The system comprises one or more storage devices communicably coupled to one or more computers, wherein the one or more storage devices store instructions that cause the one or more computers to execute the method described in any one of claims 1 to 17 when executed by the one or more computers. system.

Images