-DP ϵ Tϵ Model is: (O( Tϵ), δ)-DP Concentrated DP Zero Concentrated DP Rènyi DP Moments Accountant [Dwork et al. (2016)] [Bun & Steinke (2016)] [Abadi et al. (2016)] [Mironov (2017)] Data Machine Learning Deﬁne Objective Function Iterate for T epochs: Calculate Gradients Update Model M Gradient Perturbation
class classiﬁcation on CIFAR-100 100 class classiﬁcation on Purchase-100 Accuracy Loss Privacy Leakage Code Available: https://github.com/bargavj/EvaluatingDPML
5 10 50 100 500 1000 NC zCDP RDP RDP has 0.10 accuracy loss at = 10 and NC at = 500 Privacy Budget ϵ Accuracy Loss ϵ ϵ Logistic Regression on CIFAR-100
FPR) M1 M2 Mk A Expected Training Loss 1 n n ∑ i=1 ℓ(di , θ) Reza Shokri, Marco Stronati, Congzheng Song, Vitaly Shmatikov (S&P 2017) Samuel Yeom, Irene Giacomelli, Matt Fredrikson, Somesh Jha (CSF 2018) Privacy Leakage
2 >= 3 >= 4 = 5 Number of times identiﬁed as member (out of 5 runs) True Members Non Members 0.822 PPV 0.817 PPV 0.797 PPV 0.749 PPV 0.656 PPV 0.500 PPV Fraction of Data Set Random, Independent Predictions
0.01 0.05 0.1 0.5 1 5 10 50 100 500 1000 Privacy Budget ϵ Accuracy Loss Privacy Leakage Theoretical Guarantee RDP Acc Loss RDP Leakage NC Acc Loss Conclusion Non-private model has 0.12 leakage with 0.56 PPV 0.55 PPV There is privacy leakage, but not considerable, even for non-private model Logistic Regression on CIFAR-100 NC Leakage
0.01 0.05 0.1 0.5 1 5 10 50 100 500 1000 Privacy Budget ϵ Accuracy Loss Privacy Leakage Theoretical Guarantee RDP Acc Loss RDP Leakage NC Acc Loss NC Leakage Bridging the gap between theoretical bound on leakage and the leakage of practical attacks Conclusion Neural Network on CIFAR-100 Non-private model has 0.72 leakage with 0.94 PPV 0.74 PPV Privacy doesn’t come for free
0.01 0.05 0.1 0.5 1 5 10 50 100 500 1000 Privacy Budget ϵ Accuracy Loss Privacy Leakage Theoretical Guarantee RDP Acc Loss RDP Leakage NC Acc Loss Bridging the gap between theoretical bound on leakage and the leakage of practical attacks Conclusion Questions? Thank You! Bargav Jayaraman bj4nq@virginia.edu Privacy doesn’t come for free NC Leakage https://github.com/bargavj/EvaluatingDPML