We propose Bayesian differential privacy, a relaxation of differential privacy for similarly distributed data, that provides sharper privacy guarantees in difficult scenarios, such as deep learning. We also derive a general privacy accounting method for iterative learning algorithms under Bayesian differential privacy and show that it is a generalisation of the well-known moments accountant. Our experiments demonstrate significant advantage over the state-of-the-art differential privacy bounds for deep learning models on classic supervised learning tasks, bringing the privacy budget from 8 down to 0.5 in some cases. Lower amounts of injected noise also benefit the model accuracy and the speed of learning. Additionally, we demonstrate applicability of Bayesian differential privacy to variational inference and achieve the state-of-the-art privacy-accuracy trade-off.
Privacy analysis in the context of differentially private ML is often done and lies in finding parameters @math (or bounds on it) that apply to the entire learning process, as opposed to fixing @math beforehand and calibrating noise to satisfy it. Due to the nature of such analysis (keeping track and accumulating some quantity representing privacy loss during training) it is referred to as . The simplest accounting can be done by using basic and advanced composition theorems @cite_33 . However, bounds on @math obtained this way are prohibitively loose: using basic composition for big neural networks, @math can be in order of millions, so the DP guarantee loses any meaning.
@cite_33
2130964760
We examine the information-theoretic foundations of the increasingly popular notion of differential privacy. We establish a connection between differential private mechanisms and the rate-distortion framework. Additionally, we also show how differentially private distributions arise out of the application of the Maximum Entropy Principle. This helps us locate differential privacy within the wider framework of information-theory and helps formalize some intuitive aspects of our understanding of differential privacy.