Learning the Privacy-Utility Trade-off with Bayesian Optimization - - PowerPoint PPT Presentation

Learning the Privacy-Utility Trade-off with Bayesian Optimization

Borja Balle

Joint work with B. Avent, J. Gonzalez, T. Diethe and A. Paleyes

Privacy Utility

Theory vs Practice

O

• d (/δ)

nε

• <latexit sha1_base64="9kDpveEaFLU+Unv7fLX8RADi8cg=">ADgXicbVLbtNAEN3WXEq4pcAbLxZVpUSKgl1UKqQKkCUBySKIG2lOIo267Gzynptdsch0coSH8ILX8MrPIXfAJru0h1wkhrzZ4zF8/smWSCa/S83xubzpWr165v3WjdvHX7zt329r1TneaKwYClIlXnE6pBcAkD5CjgPFNAk4mAs8nsVcmfzUFpnspPuMxglNBY8ogzihYatw/fBwIi7ASRoswE+rNCE7qBSO/zgIQSDtFoWRbjCnCjLNRSqLQPF4it1xe8fre5W5645/4ewcvfn64Fv69M/JeHuzH4QpyxOQyATVeuh7GY4MVciZgKIV5BoymY0BhNDmgCqpUX/uQZhgV94iNMXvseSRvzQupImoEem2krh7lokdKNU2SPRrdBGB5povUwmNjKhONWrXAn+jxvmGB2MDJdZjiBZ3SjKhYupW67YDbkChmJpHcoUt7O5bErtftE+RKML5ALUvDmIqRpmwJroIpecpeHKkhYCF6ioBTVgQrksRzXHXAj3I5W6aO3WhK1YMp3XPOaoe+/s68vesQKYdS9HX5yAXbPZYsZyOzqFfasoKIrNCqm0mWZd2aMWVcYbz+84Oe1y+Pt28/r7NAau/KtQE64n1nwuQclnVHEZWnXYUhkWLaswf1VP687pXt9/0vc+WKm9JLVtkYfkEekQnzwjR+QtOSEDwsh38oP8JL8cx+k6nrNXh25uXOTcJw1zDv8C/mMsAg=</latexit>

Plot from J. M. Abowd “Disclosure Avoidance for Block Level Data and Protection of Confidentiality in Public Tabulations” (CSAC Meeting, December 2018)

Example: DP-SGD

Input: dataset z = (z1, . . . , zn) Hyperparameters: learning rate ⌘, mini-batch size m, number of epochs T, noise variance 2, clipping norm L Initialize w 0 for t 2 [T] do for k 2 [n/m] do Sample S ⇢ [n] with |S| = m uniformly at random Let g 1

m

P

j∈S clipL(r`(zj, w)) + 2L m N(0, 2I)

Update w w ⌘g return w

• 5+ hyper-parameters affecting both privacy and utility
• For convex problems can be set to achieve near-optimal rates
• For deep learning applications we don’t have (good) utility bounds

[Bassily et al. 2014; Abadi et al. 2016]

Privacy-Utility Pareto Front

• 1. Efficient to compute
• 2. Use empirical utility measurements
• 3. Enable fine-grained comparisons

Desiderata

10−1 100 101

ε

0.0 0.2 0.4 0.6 0.8 1.0

Classification error

MNIST Pareto Fronts

MLP1 MLP2

Problem Formulation

A = {Aλ : Z → W | λ ∈ Λ}

Parametrized Algorithm Class Error (Utility) Oracle Privacy Oracle

E : Λ → [ ]

P : Λ → [ ∞)

• Eg. DP-SGD
• Eg. Expected

classification error

• Eg. Epsilon for

fixed delta

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Pareto-Optimal Points

Hyper-parameter Space Privacy Loss Error

Bayesian Optimization (BO)

• Gradient-free
• ptimization for black-

box functions

• Widely used in

applications (HPO in ML, scheduling & planning, experimental design, etc)

Bayesian Optimization (BO)

• Gradient-free
• ptimization for black-

box functions

• Widely used in

applications (HPO in ML, scheduling & planning, experimental design, etc)

λ⋆ = argmin

λ∈Λ

F(λ)

F : Λ ⊂ Rp → R

Input: Goal:

Expensive, non-convex, smooth

Bayesian Optimization (BO)

• Gradient-free
• ptimization for black-

box functions

• Widely used in

applications (HPO in ML, scheduling & planning, experimental design, etc)

λ⋆ = argmin

λ∈Λ

F(λ)

F : Λ ⊂ Rp → R

Input: Goal:

Expensive, non-convex, smooth

Bayesian Optimization Loop: (λ F(λ)) (λk F(λk))

Given k evaluations

• 1. Build a surrogate model for F (eg. Gaussian process)
• 2. Find most promising next evaluation

BO: 1-Dimensional Example

BO: 1-Dimensional Example

BO: 1-Dimensional Example

BO: 1-Dimensional Example

BO: 1-Dimensional Example

BO: 1-Dimensional Example

BO: 1-Dimensional Example

BO: 1-Dimensional Example

BO: 1-Dimensional Example

The DPareto Algorithm

Input: hyperparameter set Λ, privacy oracle P, error oracle E, anti-ideal point v†, number

• f initial points k0, number of iterations k,

prior GP Initialize dataset D ; for i 2 [k0] do Sample random point λ 2 Λ Evaluate oracles v (P(λ), E(λ)) Augment dataset D D [ {(λ, v)} for i 2 [k] do Fit a GP to the transformed privacy using D Fit a GP to the transformed utility using D Optimize the HVPoI acquisition function in

• Eq. (2) using anti-ideal point v† and obtain a

new query point λ Evaluate oracles v (P(λ), E(λ)) Augment dataset D D [ {(λ, v)} return Pareto front PF({v | (λ, v) 2 D})

• Find privacy-utility Pareto front

using multi-objective Bayesian

• ptimization
• Use transformed Gaussian

processes to model privacy and error oracles

• Acquisition function optimizes

hyper-volume based probability of improvement [Couckuyt et al. 2014]

Example: Sparse Vector Technique

10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

ε

2000 4000 6000 8000 10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

1 − F1

0.0 0.2 0.4 0.6 0.8 10−1 100 101 102

ε

0.0 0.2 0.4 0.6 0.8 1.0

1 − F1

Pareto front

10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

Pareto inputs

Input: dataset z, queries q1, . . . , qm Hyperparameters: noise b, bound C c 0, w (0, . . . , 0) 2 {0, 1}m b1 b/(1 + (2C)1/3), b2 b b1, ρ Lap(b1) for i 2 [m] do ν Lap(b2) if qi(z) + ν 1

2 + ρ then

wi 1, c c + 1 if c C then return w return w

[Lyu et al. 2017]

Setup

• 100 queries with 0/1 output, sensitivity 1
• 10% queries return 1 (randomly selected)
• Privacy: SVT analysis
• Error: 1 - F-score (avg. over 50 runs)

Example: Sparse Vector Technique

10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

ε

2000 4000 6000 8000 10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

1 − F1

0.0 0.2 0.4 0.6 0.8 10−1 100 101 102

ε

0.0 0.2 0.4 0.6 0.8 1.0

1 − F1

Pareto front

10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

Pareto inputs

10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

ε (predicted)

1000 2000 3000 4000 5000 6000 7000 10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

1 − F1 (predicted)

0.0 0.2 0.4 0.6 0.8 1.0 101 102

ε

0.0 0.2 0.4 0.6 0.8

1 − F1

Pareto front

True Pareto Empirical Pareto Observation outputs Non-dominated set ˜ Γ 10−2 10−1 100 101 102

b

5 10 15 20 25 30

C

HVPoI

Next location 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

Implementing the Oracles

Privacy Oracle

• Epsilon for fixed delta / Others DP variants / Attacks success metrics
• Closed-form expression / Numerical calculation (eg. moments accountant)

Error Oracle

• Fixed input / Distribution over inputs / Worst-case (over a set of) inputs
• On expectation / With high probability
• Exact expression / Empirical evaluation

Implementing the Oracles

Privacy Oracle

• Epsilon for fixed delta / Others DP variants / Attacks success metrics
• Closed-form expression / Numerical calculation (eg. moments accountant)

Error Oracle

• Fixed input / Distribution over inputs / Worst-case (over a set of) inputs
• On expectation / With high probability
• Exact expression / Empirical evaluation

Machine Learning Experiments

• Adult dataset (n=40K, d=123)
• Logistic regression (SGD and ADAM)
• Linear SVM (SGD)
• MNIST dataset (n=60K, d=784)
• MLP1 (1000 hidden)
• MLP2 (128-64 hidden)

10−1 100

ε

0.150 0.175 0.200 0.225 0.250 0.275 0.300

Classification error

Adult Pareto Fronts

LogReg+SGD LogReg+ADAM SVM+SGD 10−1 100 101

ε

0.0 0.2 0.4 0.6 0.8 1.0

Classification error

MNIST Pareto Fronts

MLP1 MLP2

DPareto vs Random Sampling

100 200

Sampled points

7.0 7.5 8.0 8.5 9.0

PF hypervolume

Hypervolume Evolution

MLP1 (RS) MLP1 (BO) MLP2 (RS) MLP2 (BO) 10−1 100 101

ε

0.0 0.2 0.4 0.6 0.8 1.0

Classification error

MLP2 Pareto Fronts

Initial +256 RS +256 BO 10−1 100 101

ε

0.16 0.18 0.20 0.22 0.24

Classification error

LogReg+SGD Samples

1500 RS 256 BO

Conclusion

• Empirical privacy-utility trade-off evaluation enables application-specific

decisions

• Bayesian optimization provides computationally efficient method to

recover the Pareto front (esp. with large number of hyper-parameters) Future work:

• Address leakage in Pareto front (when error oracle is input-specific)
• Include further criteria (eg. running time of parametrized algorithm)