Learning the Privacy-Utility Trade-off with Bayesian Optimization Borja Balle Joint work with B. Avent, J. Gonzalez, T. Diethe and A. Paleyes
Utility Privacy
<latexit sha1_base64="9kDpveEaFLU+Unv7fLX8RADi8cg=">ADgXicbVLbtNAEN3WXEq4pcAbLxZVpUSKgl1UKqQKkCUBySKIG2lOIo267Gzynptdsch0coSH8ILX8MrPIXfAJru0h1wkhrzZ4zF8/smWSCa/S83xubzpWr165v3WjdvHX7zt329r1TneaKwYClIlXnE6pBcAkD5CjgPFNAk4mAs8nsVcmfzUFpnspPuMxglNBY8ogzihYatw/fBwIi7ASRoswE+rNCE7qBSO/zgIQSDtFoWRbjCnCjLNRSqLQPF4it1xe8fre5W5645/4ewcvfn64Fv69M/JeHuzH4QpyxOQyATVeuh7GY4MVciZgKIV5BoymY0BhNDmgCqpUX/uQZhgV94iNMXvseSRvzQupImoEem2krh7lokdKNU2SPRrdBGB5povUwmNjKhONWrXAn+jxvmGB2MDJdZjiBZ3SjKhYupW67YDbkChmJpHcoUt7O5bErtftE+RKML5ALUvDmIqRpmwJroIpecpeHKkhYCF6ioBTVgQrksRzXHXAj3I5W6aO3WhK1YMp3XPOaoe+/s68vesQKYdS9HX5yAXbPZYsZyOzqFfasoKIrNCqm0mWZd2aMWVcYbz+84Oe1y+Pt28/r7NAau/KtQE64n1nwuQclnVHEZWnXYUhkWLaswf1VP687pXt9/0vc+WKm9JLVtkYfkEekQnzwjR+QtOSEDwsh38oP8JL8cx+k6nrNXh25uXOTcJw1zDv8C/mMsAg=</latexit> Theory vs Practice �� � d ��� ( � / δ ) O n ε Plot from J. M. Abowd “Disclosure Avoidance for Block Level Data and Protection of Confidentiality in Public Tabulations” (CSAC Meeting, December 2018)
Example: DP-SGD Input: dataset z = ( z 1 , . . . , z n ) Hyperparameters: learning rate ⌘ , mini-batch size m , number of epochs T , noise variance � 2 , clipping norm L Initialize w 0 for t 2 [ T ] do for k 2 [ n/m ] do Sample S ⇢ [ n ] with | S | = m uniformly at random j ∈ S clip L ( r ` ( z j , w )) + 2 L Let g 1 m N (0 , � 2 I ) P m Update w w � ⌘ g return w • 5+ hyper-parameters a ff ecting both privacy and utility • For convex problems can be set to achieve near-optimal rates • For deep learning applications we don’t have (good) utility bounds [Bassily et al. 2014; Abadi et al. 2016]
Privacy-Utility Pareto Front Desiderata MNIST Pareto Fronts 1 . 0 MLP1 MLP2 0 . 8 Classification error 1. E ffi cient to compute 0 . 6 2. Use empirical utility measurements 0 . 4 0 . 2 3. Enable fine-grained comparisons 0 . 0 0 10 − 1 10 0 10 1 ε
<latexit sha1_base64="CUn8cS7i9fYIDlg1WBH2pLx6Qzk=">ADi3icbVLdbtMwGPUafkZh0IHEDVxYmyYNqYoSpokxmLQB07jYxRB0nWiqynW+tlYdJ7KdkcjkWXgArngULoGXwUmKtHRYcnRyzmd/+U7OFMac/7tdJybty8dXv1TvuvbX7DzrD89VnEoKPRrzWF6MiQLOBPQ0xwuEgkGnPoj+dvS71/CVKxWHzSeQLDiEwFmzBKtKVGneMgInpGCTdHBT7AgcFHIxNwe0FICryP+NAx7iPg1f4a/lYSDhgAgenC1yMOpue61ULXwf+AmwebqDWt8c/np6N1ltuEMY0jUBoyolSA9L9NAQqRnlULSDVEFC6JxMwUwhjkDL3L/oNGQ6S8s1LMD36NRo35goSARqKGp/CnwlmVCPIml3ULjim10IJFSeTS2laUbalkryf9pg1RP9oaGiSTVIGjdaJybC0rzcYhk0A1zy0gVDI7G6YzIgnV9pc0ukDKQV42BzFVwRok81SwWgcLpmUcZ1pSypQEeEiXJUc8I4x+JUEV7qxbsjaWy/Y5NmVbdU5sD0T2RAPNnV6uvTpmBdbtLo3w+NFltaTsIYWIjV72ZK9CVCmrCuM57c63pub1d+/B37RmwSaxKTXD9YP3lHMS01BMimQhtOuxViS7aNmH+cp6ug/Pnr/jeh9s1N6geq2iJ2gDbSMfvUCH6D06Qz1E0Xf0E/1Gf5w1Z8fZd17Xpa2VxZlHqLGc478R0ytG</latexit> <latexit sha1_base64="yFd9fxwOuVIYFyEkmawDQxwenc=">ADW3icbVJda9RAFJ1u/Kix6lapL/owtBQqLCFRilUQih/Uhz5UdNvCJpTZyd3dYWcmYWZSE4b9LeKrPvlzfPC/OEkqNLsOTDg59x7c2/uOdMmzD8vdbzbty8dXv9jn934979B/3Nh6c6KxSFIc14ps7HRANnEoaGQ7nuQIixhzOxvN3tX52CUqzTH4xVQ6JIFPJowS46iL/tYH/BrHxy4gJTg2GR6Fgyi56O+EQdgcvAqiK7BzuI163x7/enpysdkL4jSjhQBpKCdaj6IwN4klyjDKYeHhYac0DmZgp1CJsCoyrH/oDVQmq8sNbM3UhFxz9yUBIBOrFNvwu865gUTzLlrjS4YTsViNC6EmPnFMTM9LJWk/TRoWZHCSWybwIGlbaFJw7OZSDw+nTAE1vHKAUMVcb5jOiCLUuBF3qkDBQV12G7FNwRxoly0LyWiWLg2p5KY0ijhSgxGEybpVe8Q4x5+J1At/txVcxlrZe8+mzOjBsfuvcnCkAObPruvd1mCm/aAimqe2LIdqR+nMHEr1LxZUdV5W8XWvoUNg1cHgzCob7jvHtG+iwG3WY3VxquB7ZdzkNaz4liMnXb4VLlZuG7DYuW92kVnD4PohdB+Mmt2lvUnX0BG2jPRShl+gQfUQnaIgosug7+oF+9v54nud7G621t3YV8wh1jrf1FwsCGbM=</latexit> <latexit sha1_base64="oyXPwVlGjlMOWU17+3SHjT4QY0c=">ADYHicbVJNa9tAEN3Y/XDdj9gt9JD2IBICRghpYSmhUJoC+khB5fWScAyYb0a2YtXK7E7Si2Eof+kt17b/pxe+0s6klKI7Q6smH3vzYxmdsapkhY97/dGo3nr9p27rXvt+w8ePtrsdB+f2SQzAgYiUYm5GHMLSmoYoEQF6kBHo8VnI9n70r+/AqMlYn+jHkKo5hPtIyk4EjQZWer7x2glMKCLkTYOIMvV4gdYT5/mVnx3O9ypx1x792do63WePb01/P+5fdhuEichi0CgUt3boeymOCm5QCgWLdpBZSLmY8QkUE0hiQJMT+s8tEOb4RY4feN7Il7SD8nVPAY7KqmF84uIaETJYaORqdClyrw2No8HpMy5ji1q1wJ/o8bZhgdjQqp0wxBi7pQlCmHhlNO0AmlAYEqJ4cLI6k3R0y54QJpzktVIFNgrpYbKaqCKYhldJ5pKZJwZUhzhXM0nEALGHN6F2q1OJFKOZ+4tov2bk1QxpLZey8nEm3vlB5X904MwGz/pvpml3OgafdEnM9GxbweaTsIaI9qm5FnJd5a6YodYvCc18d9Ty3PN4hfxDigFar0paBOuB9Z8r0JOST7mROqTtoFQpLtq0Yf7qPq07Zweu/8L1PtKqvW1tdgzts32mM9esmP2gfXZgAn2lX1nP9jPxp9mq7nZ7NbSxsZ1zBO2ZM2tvzIPHBE=</latexit> Problem Formulation Parametrized Algorithm Class A = { A λ : Z → W | λ ∈ Λ } Eg. DP-SGD Error (Utility) Oracle Eg. Expected E : Λ → [ �� � ] classification error Privacy Oracle Eg. Epsilon for P : Λ → [ �� ∞ ) fixed delta
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Pareto-Optimal Points Error Privacy Loss Hyper-parameter Space
Bayesian Optimization (BO) • Gradient-free optimization for black- box functions • Widely used in applications (HPO in ML, scheduling & planning, experimental design, etc)
<latexit sha1_base64="TGEkGqWC2Y2pTh7doXDXE9iPXA=">ADiHicbVJdb9MwFPVWPkb56uCRF4tpUidVQKqtj1MmgpiPOxhCLpNakrlOretVduJ7JvRysof4Jfwa3gF3vkZPOAkRVpbLDk6OefYN/fmjFIpLAbBr63t2p279+7vPKg/fPT4ydPG7rNLm2SGQ48nMjHXI2ZBCg09FCjhOjXA1EjC1Wj2ptCvbsBYkehPuEhoNhEi7HgD01bHQj6c0x+wi8zk9IRGiuE0SR0zEyV0PnRLC42EptF5iXP6rmkD4aNvaAdlItugnAJ9k675HfU+frnYri73Y7ihGcKNHLJrO2HQYoDXxAFl5DXo8xCyviMTcBNIFGAZuHZf9AhzPGLiHF6EgZcrfj7HmqmwA5cOZyc7nsmpuPE+K2RluxKBasXaiRdxaN23WtIP+n9TMcHw2c0GmGoHlVaJxJigktJk1jYCjXHjAuBG+N8qnzDCO/n+sVIFMgrlZbcSVBVPgq+w804In8dqQ5hLnaJgnLaBiQhetujMhJf3ItM3r+5XgbyU5lsxEWhb5z4EunVmAGYHt923u5yDn3aLq8Vs4ObVSOtRDGOft/LNqUVxb6W4wpe7oH181AraxQ46/hF2/BnwMSytLto8WH25BD0p9JQZoWOfDn9VindJyxcz9MmuHzVDl+3gw9l1Kq1Q16Ql6RJQnJITsl7ckF6hJNv5Dv5QX7W6rWgdlg7rqzbW8sz8nKqnX/Aix3LoY=</latexit> <latexit sha1_base64="7mCaJAcfnko16yIWReBdRKtLbmA=">ADdXicbVLdbtMwFPZafkb56+ASgSzK0JCqLAFNDCTEBIhxsYsN6DZpKZXjnLZWHSeynZHIyuUegXdB4hYegmfgHm5xkiE1LUdydPx95yfn8wkSzpR23Z8rfaFi5cur17pXL12/cbN7tqtQxWnksKAxjyWxwFRwJmAgWaw3EigUQBh6Ng9rkj05BKhaLjzpPYBiRiWBjRom20Ki7+RY/x/6eTQgJ9lUaKNDYj4ieBoF5X3xKsK/jOWDU7bmOWxledrxzp/fy9m9rwe/zvZHay3HD2OaRiA05USpE89N9NAQqRnlUHT8VEFC6IxMwEwgjkDL3KL/XKMh059ZqKcvPJdGjfgT6woSgRqaSokCr1skxONY2iM0rtBGBxIplUeBjSxHUotcCf6PO0n1eHtomEhSDYLWjcYpx1acUlYcMglU89w6hEpmZ8N0SiSh2orf6AIpB3naHMRUDROgTRLBaNxuCBSxnWmJbGgfauIMFGOanYZ5/gDEarorNeErVgyG2/YhGnV37MvLvq7EmD2aD56fsoMrNp9GuWzoclqSTt+CGO7XNXNRHlZt2ZMGVcY13m23Xed8rhb9uNt2RywO1eFGn85sf5zDmJS8gmRTIR2O2ypRBcdu2He4j4tO4ePHe+J4x64vZ1XqLZVdAfdRxvIQ0/RDnqH9tEAUfQFfUPf0Y/Wn/bd9oP2wzq0tXKecxs1rL35FxbGKAY=</latexit> Bayesian Optimization (BO) Expensive, F : Λ ⊂ R p → R Input: non-convex, smooth • Gradient-free optimization for black- λ ⋆ = argmin F ( λ ) Goal: box functions λ ∈ Λ • Widely used in applications (HPO in ML, scheduling & planning, experimental design, etc)
Recommend
More recommend