Scalable Differential Privacy with Certified Robustness in - PowerPoint PPT Presentation

The 37th International Conference on Machine Learning (ICML’20), Jul 12 th - 18 th , 2020. Scalable Differential Privacy with Certified Robustness in Adversarial Learning NhatHai Phan 1 , My T. Thai 2 , Han Hu 1 , Ruoming Jin 3 , Tong Sun 4 , and Dejing Dou 5 1 Ying Wu College of Computing, New Jersey Institute of Technology 2 Department of Computer & Information Sciences & Engineering, University of Florida 3 Computer Science Department, Kent State University 4 Adobe Research Lab 5 Computer and Information Science Department, University of Oregon Email: phan@njit.edu 1

Outline • Motivation and Background • Differential Privacy (DP) in Adversarial Learning • Composition of Certified Robustness • Stochastic Batch Training (StoBatch) • Experimental Results and Conclusion 2

Motivation • DNNs are vulnerable to both privacy • Bounding the robustness of a model attacks and adversarial examples (protects data privacy and is robust against adversarial examples) at scale is nontrivial • Existing efforts only focus on either preserving DP or deriving certified • adversarial examples introduces a previously unknown privacy risk robustness, but not both DP and robustness! • unrevealed interplay (trade-off) among • private models are unshielded under DP preservation, adversarial learning, adversarial examples and robustness bounds • robust models (adversarial training) do not offer privacy protections to the training data 3

Goals • Develop a novel mechanism (StoBatch) to: 1) preserve DP of the training data, 2) be provably and practically robust to adversarial examples, 3) retain high model utility, and 4) be scalable. Methods Results • Privacy-preserving (Laplace) noise is • Established a connection among DP injected into inputs and hidden layers to preservation to protect the training data, achieve DP in learning private model adversarial learning, and certified robustness. parameters. • Derived a sequential composition robustness in both input and latent spaces. The privacy noise 𝑞 is projected on the • • Addressed the trade-off among model utility, scale of the robustness noise 𝑠 . privacy loss, and robustness. – a composition of certified robustness in both • Rigorous experiments shown that our input and latent spaces mechanism significantly enhances the robustness and scalability of DP DNNs. • Leverage the recipe of distributed adversarial training to develop a Deliverables stochastic batch training – disjoint and fixed batches are distributed to • Algorithms and models: local DP trainers https://github.com/haiphanNJIT/StoBatch

Differential Privacy • Databases 𝐸 and 𝐸’ are neighbors if they are different in one individual’s contribution • (𝜗, 𝜀) -Differential Privacy: for all 𝐸, 𝐸 ’ neighbors, the distribution of A 𝐸 is (nearly) the same as the distribution of 𝐵 𝐸′ for all 𝐩 : privacy loss 5

DP Mechanisms [Chaudhuri & Sarwate] 6

Robustness Condition [Lécuyer et al., 2019] ∀𝛽 ∈ 𝑚 ' 𝜈 : 𝑔 ( 𝑦 + 𝛽 > max ):)+( 𝑔 ) 𝑦 + 𝛽 where 𝑙 = 𝑧(𝑦) , indicating that a small perturbation in the input does not change the predicted label 𝑧(𝑦) . 7

DP with Certified Robustness [Lécuyer et al., 2019] $ • Image level: 𝑦 = 𝑦 + 𝑂 0, 𝜏 # -./0 • 𝜏 , ≥ 2 ln ∆ , /𝜗 , 1 ! 8

Outline • Motivation and Background • Differential Privacy in Adversarial Learning • Composition of Certified Robustness • Stochastic Batch Training (StoBatch) • Experimental Results and Conclusion 9

Differential Privacy in Adversarial Learning [Overview] • • easier to train, small sensitivity bounds, and reusability 10

̅ DP Auto-Encoder 8 1 2 𝜄 -6 6 6 ℛ 2 3 " 𝜄 - = : : ℎ ) − ̅ 𝑦 ) ? 𝑦 ) 4 # ∈ 2 67- 3 " 𝑦 ) = 𝑦 ) + 1 𝑛 𝑀𝑏𝑞 ∆ ℛ 𝑦 ) + 2 𝑛 𝑀𝑏𝑞 ∆ ℛ : ̅ , and 6 ℎ ) = 𝜄 - 𝜁 - 𝜁 - DP 11

Adversarial Learning with DP • DP Adversarial Examples • DP Objective function privacy leakage 12

Algorithm 13

Outline • Motivation and Background • Differential Privacy in Adversarial Learning • Composition of Certified Robustness • Stochastic Batch Training (StoBatch) • Experimental Results and Conclusion 14

̅ Composition of Certified Robustness • Project the privacy noise 𝑞 on the scale of the robustness noise 𝑠 . $ $ 𝜆 = ∆ ℛ / ∆ # 𝑦 % = 𝑦 % + 𝑀𝑏𝑞 𝜆∆ # , 𝑛𝜁 " 𝜁 # 𝜁 # 𝜆 + 𝜒 - 𝜈 & & 𝜒 = ∆ ℛ / ∆ # ℎ % = ℎ % + 𝑀𝑏𝑞 𝜒∆ # 𝜆 + 𝜒 / , 𝑛𝜁 " 𝜁 # 𝜁 # 𝑦 𝜈 • What is the general robustness bound, given 𝜆 and 𝜒 ? Sequential Composition of Certified Robustness: Lemma 5, Theorem 5 15

Verified Inference • StoBatch Robustness ∀𝛽 ∈ 𝑚 ' 𝜆 + 𝜒 ()$ : 𝑔 * 𝑦 + 𝛽 > max %:%,* 𝑔 % 𝑦 + 𝛽 where 𝑙 = 𝑧(𝑦) , indicating that a small perturbation in the input does not change the predicted label 𝑧(𝑦) . 16

Stochastic Batch Mechanism • Under the same DP protection. • Training from multiple batches with more adversarial examples, without affecting the DP bound. • The optimization of one batch does not affect the DP protection at any other batch and at the dataset level 𝐸 , across 𝑈 training steps. 17

Outline • Motivation and Background • Differential Privacy in Adversarial Learning • Composition of Certified Robustness • Stochastic Batch Training (StoBatch) • Experimental Results and Conclusion 18

Experimental Results • Interplay among model utility, • Baseline approaches privacy loss, and robustness • PixelDP [Lecuyer et al., S&P’19] bounds • DPSGD [Abadi et al., CCS’16] • privacy budget • AdLM [Phan et al., ICDM’17] • attack sizes • Secure-SGD [Phan et al., IJCAI’19] with AGM [Balle et al., ICML’18] • scalability • CNNs on MNIST, CIFAR-10 • ResNet-18 on Tiny ImageNet [Lécuyer et al., 2019] 19

CIFAR-10 • StoBatch • 45.25 ± 1.6% (conventional) • 42.59 ± 1.58% (certified) • SecureSGD • 29.08 ± 11.95% (conventional) • 19.58 ± 5.0% (certified) • p < 2.75e-20 • 2-tail t-test 20

Tiny ImageNet • StoBatch • 29.78 ± 4.8% (conventional) • 28.31 ± 1.58% (certified) • SecureSGD • 8.99 ± 5.95% (conventional) • 8.72 ± 5.5% (certified) • p < 1.55e-42 • 2-tail t-test 21

Conclusion • Established a connection among DP preservation to protect the training data, adversarial learning, and certified robustness. • Derived a sequential composition robustness in both input and latent spaces. • Addressed the trade-off among model utility, privacy loss, and robustness. • Rigorous experiments shown that our mechanism significantly enhances the robustness and scalability of DP DNNs. 22

The 37th International Conference on Machine Learning (ICML’20), Jul 12 th - 18 th , 2020. Thank you! phan@njit.edu, we are hiring! 23