Assessing Differentially Private Variational Autoencoders under Membership Inference
This work addresses the challenge for data scientists in setting privacy parameters for Variational Autoencoders, but it is incremental as it builds on prior research in differential privacy.
The paper tackled the problem of evaluating the privacy-accuracy trade-off for differentially private Variational Autoencoders under membership inference attacks, finding that trade-offs depend heavily on dataset and model architecture, with rarely favorable outcomes and one case where local differential privacy outperformed central differential privacy.
We present an approach to quantify and compare the privacy-accuracy trade-off for differentially private Variational Autoencoders. Our work complements previous work in two aspects. First, we evaluate the the strong reconstruction MI attack against Variational Autoencoders under differential privacy. Second, we address the data scientist's challenge of setting privacy parameter epsilon, which steers the differential privacy strength and thus also the privacy-accuracy trade-off. In our experimental study we consider image and time series data, and three local and central differential privacy mechanisms. We find that the privacy-accuracy trade-offs strongly depend on the dataset and model architecture. We do rarely observe favorable privacy-accuracy trade-off for Variational Autoencoders, and identify a case where LDP outperforms CDP.