论文标题
计算机视觉中的混合差异隐私
Mixed Differential Privacy in Computer Vision
论文作者
论文摘要
我们介绍了一种自适应差异化私有算法，用于使用私人图像和公共图像数据培训深神网络分类器。虽然大型公共数据集中的培训前语言模型已使强大的差异隐私（DP）保证且准确性较小，但类似的做法会惩罚视力任务中的权衡。忽略私人数据的几次射击甚至零射击基线可以在大型私人数据集上进行微调。在私人微调之前，Adamix在公共数据上纳入了很少的射击培训或跨模式零射击学习，以改善权衡取舍。 Adamix将误差从非私有的上限从基线的167-311 \％（平均6个数据集）减少到68-92 \％，具体取决于用户选择的所需的隐私级别。 Adamix解决了视觉分类中产生的权衡，在这种分类中，对应于表示空间中孤立点的最隐私敏感数据对于高分类精度也至关重要。此外，Adamix具有强大的理论隐私保证和融合分析。
We introduce AdaMix, an adaptive differentially private algorithm for training deep neural network classifiers using both private and public image data. While pre-training language models on large public datasets has enabled strong differential privacy (DP) guarantees with minor loss of accuracy, a similar practice yields punishing trade-offs in vision tasks. A few-shot or even zero-shot learning baseline that ignores private data can outperform fine-tuning on a large private dataset. AdaMix incorporates few-shot training, or cross-modal zero-shot learning, on public data prior to private fine-tuning, to improve the trade-off. AdaMix reduces the error increase from the non-private upper bound from the 167-311\% of the baseline, on average across 6 datasets, to 68-92\% depending on the desired privacy level selected by the user. AdaMix tackles the trade-off arising in visual classification, whereby the most privacy sensitive data, corresponding to isolated points in representation space, are also critical for high classification accuracy. In addition, AdaMix comes with strong theoretical privacy guarantees and convergence analysis.
