| Other Abstract | Developing and applying deep learning models are inseparable from collecting and using large-scale training data. However, these data usually contain a large amount of private information. As a result, the trained deep learning model may pose a severe risk
of privacy leakage. In recent years, due to the frequent security problems caused by the leakage of users’ private information, data privacy protection has been paid more and more attention by many countries. Therefore, the research on privacy-preserving deep
learning technology has become a hot topic of increasing concern in both academia and industry. However, although the current privacy-preserving deep learning methods can improve privacy, they usually cause catastrophic damage to the accuracy of the deep
learning model, which seriously hinders the application of the deep learning model in real scenarios. Therefore, how to improve the accuracy of deep learning models while preserving data privacy has become an urgent problem to be solved in the current research of privacy-preserving deep learning. In order to solve this problem, this thesis conducts research from the perspectives of neural network architecture design, optimization algorithm design, differential privacy mechanism design, and deployed model
protection, aiming to improve the accuracy of private deep learning models from different perspectives. The research content and innovation of this thesis are summarized as follows:
1. Neural architecture search for privacy-preserving deep learning. To solve the problem of how to design neural networks that are friendly to privacy-preserving deep learning, this thesis presents an automatic method to design models for privacy-preserving deep learning based on neural architecture search. Firstly, a new search space is designed for privacy-preserving deep learning tasks. The selection of activation functions and the construction of model topology are the main objectives of the architecture search. Secondly, in order to make the resulting model architecture more suitable for the training process of the differentially private optimization algorithms, this thesis presents a novel candidate model training method that can perceive the effect of differential privacy. The experimental results show that the searched neural network architectures achieve state-of-the-art accuracy on multiple datasets of the privacy-preserving image classification tasks. Moreover, by analyzing the architectures of the search results, this thesis summarizes several discoveries and rules for designing model architectures for privacy-preserving deep learning.
2. Privacy-preserving federated learning with local regularization and sparsification. To solve the problem of model accuracy drop in federated learning that satisfies user-level differential privacy, this thesis conducts a theoretical analysis and finds that the key to improving model accuracy is to naturally reduce the original local update norm before conducting the differential privacy operations. Therefore, this thesis proposes two techniques to improve the local learning process in differentially
private federated learning. First, this thesis proposes a bounded local update regularization technique, which restricts the local update norms to be smaller than the clipping threshold for differential privacy by adding a regularization term to the local learning objectiveness. Secondly, this thesis proposes local update sparse technology to further reduce the local model update norm without affecting the local model update effect.
This thesis theoretically analyzes the convergence and privacy of the proposed method. The experimental results show that, for the same level of privacy, the proposed method achieves obvious advantages in both convergence speed and model accuracy, compared
with existing methods.
3. Privacy-preserving deep learning with adaptive elliptical Gaussian mechanism. In order to solve the problem of performance degradation caused by the addition of isotropic Gaussian noise in differentially private deep learning, this thesis first presents an elliptical Gaussian mechanism with differential privacy guarantees. The proposed mechanism satisfies differential privacy by adding non-isotropic Gaussian noise to the output of the high-dimensional algorithms. This thesis then presents an optimization-based adaptive parameter selection method for the parameter selection problem to apply the elliptical Gaussian mechanism to privacy-preserving deep learning tasks. This method optimizes the projection matrix and noise intensity matrix in the elliptical Gaussian mechanism with the objective of minimizing the expected error between the original gradient vector and the noise-perturbed gradient vector. Then, according to the degree of parameter sharing, three different implementations of this method are carried out. The experimental results show that the proposed method achieves better model accuracy than the existing differentially private optimization methods.
4. Accuracy-preserving generative perturbation for black-box model privacy protection. To defend the black-box model against model stealing attacks, this thesis presents a generative perturbation defense method that can preserve the protected models’ accuracy. Although the existing defense methods can reduce the success rate
of model stealing attacks, they will cause very serious damage to the accuracy of the protected models. This thesis presents a generator module that maintains the order of predicted categories. The input of the generator is the output score vector of the target model and the output of the generator is a perturbed score vector. The perturbation objective of the generator is to maximize the difference between the output vector and the input vector while keeping the sort of the predicted categories in the output vector consistent with that in the input vector, which can add as much perturbation as possible to the training process of the adversarial model while keeping the predicted category of the target model unchanged. The experimental results show that this method can effectively resist model stealing attacks and knowledge-distillation-based model cloning while totally maintaining the accuracy of the target model. Moreover, the defense effect is significantly better than the existing defense methods. |
Edit Comment