Junyangz's docs
  • Introduction
  • Ops
    • Linux-tips
    • MySQL-5.7.20
    • Upgrading MySQL
    • Upgrade OpenSSH to 7.7p1 in CentOS 6
    • Linux PERSISTENT NAMING
    • Use Kafka with Flume - CRS2
    • Setup Chroot SFTP in CentOS
    • Setup software RAID-5 in CentOS
    • SSH-port-forwarding
    • Elasticsearch In Production
    • ELK-simple-tutorial
    • Ansible Playbooks for Apache Kafka in production
    • GitHub Actions depoly Hexo
    • Test HTTP3/QUIC docker
    • Docker tutorial
    • SFTP-auth-pubkey
    • Linux Process Substitution
  • Note
    • Interview
      • interview-prepare
      • 2020-campus-recruiting
    • Android Tips
    • MacOS tips
    • Secret knowledge
    • GPG-Note
    • ud185
    • ud185-2
    • Introducing Tensorflow Federated
    • Tensorflow Federated
    • Expert Python Programing
    • What happens when zh_CN
    • TILGC
    • VScode keyboard shortcuts
    • Abseil Python
    • Latex Note
    • Git Cheatsheet
    • Study Smarter Not Harder
    • Machine Learning Interviews
    • 深度学习中的优化
    • Beej's Guide to Network Programming Note
      • ch4
      • ch5
      • ch6
      • ch7
  • [Share]
    • What to do after what to do
    • Truman is everywhere
    • Way2outer
    • 未来十五年
  • Quote
Powered by GitBook
On this page
  • Differential Privacy
  • Differential Privacy and Machine Learning

Was this helpful?

  1. Note

ud185-2

Previousud185NextIntroducing Tensorflow Federated

Last updated 2 years ago

Was this helpful?

Differential Privacy

  • Type of Noise(Gaussian / Laplacian)

  • Sensitivity of Query

  • Desired Epsilon()

  • Desired Delta()

Laplacian proof.

Definition 1.1 (ℓ1-sensitivity). The ℓ1-sensitivity of a function f : N∣X∣→Rk\mathbb{N}^{|\mathcal{X}|} \rightarrow \mathbb{R}^{k}N∣X∣→Rk is:

Δf=max⁡∥x−y∥1=1∥f(x)−f(y)∥1\Delta f=\max _{\|x-y\|_{1}=1}\|f(x)-f(y)\|_{1}Δf=∥x−y∥1​=1max​∥f(x)−f(y)∥1​

The ℓ1 sensitivity of a function f captures the magnitude by which a single individual’s data can change the function fff in the worst case, and therefore, intuitively, the uncertainty in the response that we must introduce in order to hide the participation of a single individual. Indeed, we will formalize this intuition: the sensitivity of a function gives an upper bound on how much we must perturb its output to preserve privacy. One noise distribution naturally lends itself to differential privacy.

Definition 1.2 (The Laplace Distribution). The Laplace Distribution(centered at 0) with scale b is the distribution with probability density function:

Lap⁡(x∣b)=12bexp⁡(−∣x∣b).\operatorname{Lap}(x | b)=\frac{1}{2b} \exp \left(-\frac{|x|}{b}\right).Lap(x∣b)=2b1​exp(−b∣x∣​).

Definition 1.3 (The Laplace Mechanism). Given any function f:N∣X∣→Rkf : \mathbb{N}^{|\mathcal{X}|} \rightarrow \mathbb{R}^{k}f:N∣X∣→Rk , the Laplace mechanism is defined as:

Theorem 1. The Laplace mechanism preserves (ε, 0)-differential privacy.

Differential Privacy and Machine Learning

​ [译]数据分析中最有用的任务之一是机器学习:自动查找简单规则以准确预测从未见过的数据的某些未知特征的问题。 许多机器学习任务可以在差分隐私的约束下执行。 事实上,隐私的约束并不一定与机器学习的目标相悖,两者都旨在从绘制数据的分布中提取信息,而不是从单个数据点提取信息。 在本节中,我们将调查一些关于私人机器学习的最基本结果,而不是试图完全覆盖这个大型领域。

​ 机器学习的目标通常与隐私数据分析的目标相似。学习者通常希望学习一些解释数据集的简单规则。但是,她希望这条规则能够”概括“ - 也就是说,她应该学习的规则不仅要正确描述她手边的数据,而且应该能够正确描述从中获取的新数据分布。通常,这意味着她希望学习一种规则,该规则捕获有关手头数据集的分布信息,其方式不会过于依赖任何单个数据点。当然,这正是隐私数据分析的目标 - 揭示有关私有数据集的分布信息,而不会过多地揭示数据集中的任何单个个体。毫无疑问,机器学习和隐私数据分析是紧密相连的。事实上,正如我们将要看到的,我们通常能够以几乎同样准确的方式执行隐私保护机器学习,几乎与我们可以执行非隐私保护机器学习的示例数量相同。

“if adding, modifying, or removing any of its training samples would not result in a statistically significant difference in the model parameters learned. For this reason, learning with differential privacy is, in practice, a form of regularization.”

ML(x,f(⋅),ε)=f(x)+(Y1,…,Yk)\mathcal{M}_{L}(x, f(\cdot), \varepsilon)=f(x)+\left(Y_{1}, \ldots, Y_{k}\right)ML​(x,f(⋅),ε)=f(x)+(Y1​,…,Yk​)

where YiY_{i}Yi​ are i.i.d. random variables drawn from Lap⁡(Δf/ε).\operatorname{Lap}(\Delta f / \varepsilon).Lap(Δf/ε).

Proof.Proof.Proof. Let x∈N∣X∣x \in \mathbb{N}^{|\mathcal{X}|}x∈N∣X∣ and y∈N∣X∣y \in \mathbb{N}^{|\mathcal{X}|}y∈N∣X∣ be such that ∣∣x−y∣∣1≤1||x-y||_{1} \leq 1∣∣x−y∣∣1​≤1, and let f(⋅)f(\cdot)f(⋅) be some function f:N∣X∣→Rkf : \mathbb{N}^{|\mathcal{X}|} \rightarrow \mathbb{R}^{k}f:N∣X∣→Rk. Let pxp_xpx​ denote the probability density function of ML(x,f,ε)\mathcal{M}_{L}(x, f, \varepsilon)ML​(x,f,ε), and let pyp_ypy​ denote the probability density function of ML(y,f,ε)\mathcal{M}_{L}(y, f, \varepsilon)ML​(y,f,ε). We compare the two at some arbitrary point z∈Rkz \in \mathbb{R}^{k}z∈Rk

px(z)py(z)=∏i=1k(exp⁡(−ε∣f(x)i−zi∣Δf)exp⁡(−ε∣f(y)i−zi∣Δf))=∏i=1kexp⁡(ε(∣f(y)i−zi∣−∣f(x)i−zi∣)Δf)≤∏i=1kexp⁡(ε∣f(x)i−f(y)i∣Δf)=exp⁡(ε⋅∥f(x)−f(y)∥1Δf)≤exp⁡(ε)\begin{aligned} \frac{p_{x}(z)}{p_{y}(z)} &=\prod_{i=1}^{k}\left(\frac{\exp \left(-\frac{\varepsilon\left|f(x)_{i}-z_{i}\right|}{\Delta f}\right)}{\exp \left(-\frac{\varepsilon\left|f(y)_{i}-z_{i}\right|}{\Delta f}\right)}\right) \\ &=\prod_{i=1}^{k} \exp \left(\frac{\varepsilon\left(\left|f(y)_{i}-z_{i}\right|-\left|f(x)_{i}-z_{i}\right|\right)}{\Delta f}\right) \\ & \leq \prod_{i=1}^{k} \exp \left(\frac{\varepsilon\left|f(x)_{i}-f(y)_{i}\right|}{\Delta f}\right) \\ &=\exp \left(\frac{\varepsilon \cdot\|f(x)-f(y)\|_{1}}{\Delta f}\right) \\ & \leq \exp (\varepsilon) \end{aligned}py​(z)px​(z)​​=i=1∏k​​exp(−Δfε∣f(y)i​−zi​∣​)exp(−Δfε∣f(x)i​−zi​∣​)​​=i=1∏k​exp(Δfε(∣f(y)i​−zi​∣−∣f(x)i​−zi​∣)​)≤i=1∏k​exp(Δfε∣f(x)i​−f(y)i​∣​)=exp(Δfε⋅∥f(x)−f(y)∥1​​)≤exp(ε)​

where the first inequality follows from the triangle inequality, and the last follows from the definition of sensitivity and the fact that ∣∣x−y∣∣1≤1||x-y||_{1}\leq 1∣∣x−y∣∣1​≤1. That px(z)py(z)≥exp⁡(−ε)\frac{p_{x}(z)}{p_{y}(z)} \geq \exp (-\varepsilon)py​(z)px​(z)​≥exp(−ε) follows by symmetry.