Differentially Private Synthetic Data via Influence Function Sampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for enforcing differential privacy in machine learning systems often degrade the utility of trained models, as they require training under strict privacy constraints, which can lead to low-fidelity synthetic data generation and difficulty in capturing correlations in real data sets, especially when complex models are trained without adequate data.
Innovation Solution
A method that estimates the privacy cost of generating synthetic data samples using influence functions to constrain privacy loss, allowing for the generation of synthetic data sets with differential privacy guarantees without degrading model utility, by training generative models without initial privacy guarantees and using a privacy budget for sampling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If differential privacy constraints are enforced during machine learning training, then privacy protection for individual records is improved, but the utility of the trained model deteriorates
Solution Approach 1:
The patent segments the privacy protection process into two distinct phases: (1) training the generative model without privacy constraints to maximize utility, and (2) applying differential privacy only during the sampling phase to generate synthetic data. This segmentation allows the model to achieve high utility during training while still providing privacy guarantees when generating synthetic data, resolving the contradiction between model utility and privacy protection.
Solution Approach 2:
The patent performs preliminary training of the generative model without privacy constraints before applying differential privacy measures. By completing the utility-maximizing training phase first, the model achieves optimal performance, and then differential privacy is applied only to the sampling process, preventing the utility degradation that would occur if privacy constraints were applied during training.
2Ease of manufacture
If generative models are trained without privacy guarantees, then model utility and data fidelity are improved, but privacy loss occurs when generating synthetic data
Solution Approach 1:
The patent introduces differential privacy as an intermediary mechanism between the high-fidelity generative model and the synthetic data output. The model itself remains unrestricted and achieves high fidelity, but the sampling process uses differential privacy as a mediator to ensure that the generated synthetic data does not reveal information about individual training records, thus protecting against privacy loss while maintaining data fidelity.
Solution Approach 2:
The patent extracts the privacy protection requirement from the training process and applies it only to the sampling process. By taking out the differential privacy constraint from training and applying it solely to data generation, the model can be trained on high-fidelity data without privacy restrictions, while still ensuring that the synthetic data output maintains privacy guarantees.
3Reliability
If privacy constraints are applied during training, then differential privacy guarantees are ensured, but the ability to capture correlations in real data sets deteriorates
Solution Approach 1:
The patent segments the learning process into correlation capture (during training without constraints) and privacy guarantee (during sampling with differential privacy). This allows the model to fully learn and capture complex correlations in the training data without restriction, while the differential privacy mechanism is applied only when generating synthetic data, ensuring privacy guarantees without degrading the model's ability to represent real data correlations.
4Ease of manufacture
If synthetic data is generated with high sampling rates, then data utility is improved, but privacy loss increases
Solution Approach 1:
The patent implements a feedback mechanism through the differential privacy framework, where the privacy budget (epsilon) is monitored and controlled during the sampling process. The system provides feedback on the cumulative privacy loss as synthetic data is generated, allowing the sampling rate to be adjusted or terminated when the privacy budget is exhausted. This ensures that high data utility can be achieved through extensive sampling while maintaining strict control over privacy loss.
Data Source
AI summary
Methods, techniques and systems are described for limiting privacy loss in machine learning systems. A machine learning system may produce a generative model through machine learning training using a real data set that includes information identifying one or more sources and differential privacy guarantees for data in the real data set are not ensured. The generative model may therefore model data including identifiable data for particular individuals or sources contributing to the real data set. An estimate of training sensitivity for the training of the generative model with respect to the real data set may then be made, then the machine learning system may generate a synthetic data set according to sampling of the trained generative model, where the sampling is determined by the estimate of training sensitivity and a desired level of privacy guarantee to ensure differential privacy of the data in the real data set.