Privacy Amplification by Structured Subsampling for Deep Differentially Private Time Series Forecasting
This addresses privacy concerns for sensitive sequential data like web traffic or hospital records in forecasting tasks, offering a novel theoretical framework.
The paper tackles the incompatibility of standard DP-SGD with time series forecasting due to its reliance on unstructured batches, by theoretically analyzing privacy amplification through structured subsampling for sequential data, enabling training with sound and tight privacy guarantees.
Many forms of sensitive data, such as web traffic, mobility data, or hospital occupancy, are inherently sequential. The standard method for training machine learning models while ensuring privacy for units of sensitive information, such as individual hospital visits, is differentially private stochastic gradient descent (DP-SGD). However, we observe in this work that the formal guarantees of DP-SGD are incompatible with time series specific tasks like forecasting, since they rely on the privacy amplification attained by training on small, unstructured batches sampled from an unstructured dataset. In contrast, batches for forecasting are generated by (1) sampling sequentially structured time series from a dataset, (2) sampling contiguous subsequences from these series, and (3) partitioning them into context and ground-truth forecast windows. We theoretically analyze the privacy amplification attained by this structured subsampling to enable the training of forecasting models with sound and tight event- and user-level privacy guarantees. Towards more private models, we additionally prove how data augmentation amplifies privacy in self-supervised training of sequence models. Our empirical evaluation demonstrates that amplification by structured subsampling enables the training of forecasting models with strong formal privacy guarantees.