Tempered Sigmoid Activations for Deep Learning with Differential Privacy
This addresses the need for better privacy-preserving machine learning for sensitive data by offering a novel architectural approach, though it is incremental in improving existing methods.
The paper tackles the problem of poor privacy/utility tradeoffs in differentially private deep learning by proposing to choose model architectures explicitly for privacy-preserving training, focusing on activation functions. It introduces tempered sigmoid activations, which achieve new state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10 without modifying learning procedures.
Because learning sometimes involves sensitive data, machine learning algorithms have been extended to offer privacy for training data. In practice, this has been mostly an afterthought, with privacy-preserving models obtained by re-running training with a different optimizer, but using the model architectures that already performed well in a non-privacy-preserving setting. This approach leads to less than ideal privacy/utility tradeoffs, as we show here. Instead, we propose that model architectures are chosen ab initio explicitly for privacy-preserving training. To provide guarantees under the gold standard of differential privacy, one must bound as strictly as possible how individual training points can possibly affect model updates. In this paper, we are the first to observe that the choice of activation function is central to bounding the sensitivity of privacy-preserving deep learning. We demonstrate analytically and experimentally how a general family of bounded activation functions, the tempered sigmoids, consistently outperform unbounded activation functions like ReLU. Using this paradigm, we achieve new state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10 without any modification of the learning procedure fundamentals or differential privacy analysis.