In this work we address the practical challenges of training machine learning
models on privacy-sensitive datasets by introducing a modular approach that
minimizes changes to training algorithms, provides a variety of configuration
strategies for the privacy mechanism, and then isolates and simplifies the
critical logic that computes the final privacy guarantees. A key challenge is
that training algorithms often require estimating many different quantities
(vectors) from the same set of examples --- for example, gradients of different
layers in a deep learning architecture, as well as metrics and batch
normalization parameters. Each of these may have different properties like
dimensionality, magnitude, and tolerance to noise. By extending previous work
on the Moments Accountant for the subsampled Gaussian mechanism, we can provide
privacy for such heterogeneous sets of vectors, while also structuring the
approach to minimize software engineering challenges.

本文介绍了一种模块化方法，可以最小化对训练算法的更改，提供各种隐私机制的配置策略，并隔离和简化计算最终隐私保证的关键逻辑，以解决在隐私敏感数据集上训练机器学习模型所面临的实际挑战。

迭代训练程序添加差分隐私的一般方法

A General Approach to Adding Differential Privacy to Iterative Training  Procedures

The study of private inference has been sparked by growing concern regarding
the analysis of data when it stems from sensitive sources. We present the first
method for private Bayesian inference in exponential families that properly
accounts for noise introduced by the privacy mechanism. It is efficient because
it works only with sufficient statistics and not individual data. Unlike other
methods, it gives properly calibrated posterior beliefs in the non-asymptotic
data regime.

该研究的主要内容是关于私人推断的方法，该方法为指数族的私人贝叶斯推断提供了第一个解决方案并且能够充分考虑隐私机制引入的噪声，从而提供正确校准的后验置信度。

指数族信息的差分隐私贝叶斯推断

Differentially Private Bayesian Inference for Exponential Families

Machine learning models leak information about the datasets on which they are
trained. An adversary can build an algorithm to trace the individual members of
a model's training dataset. As a fundamental inference attack, he aims to
distinguish between data points that were part of the model's training set and
any other data points from the same distribution. This is known as the tracing
(and also membership inference) attack. In this paper, we focus on such attacks
against black-box models, where the adversary can only observe the output of
the model, but not its parameters. This is the current setting of machine
learning as a service in the Internet.
We introduce a privacy mechanism to train machine learning models that
provably achieve membership privacy: the model's predictions on its training
data are indistinguishable from its predictions on other data points from the
same distribution. We design a strategic mechanism where the privacy mechanism
anticipates the membership inference attacks. The objective is to train a model
such that not only does it have the minimum prediction error (high utility),
but also it is the most robust model against its corresponding strongest
inference attack (high privacy). We formalize this as a min-max game
optimization problem, and design an adversarial training algorithm that
minimizes the classification loss of the model as well as the maximum gain of
the membership inference attack against it. This strategy, which guarantees
membership privacy (as prediction indistinguishability), acts also as a strong
regularizer and significantly generalizes the model.
We evaluate our privacy mechanism on deep neural networks using different
benchmark datasets. We show that our min-max strategy can mitigate the risk of
membership inference attacks (close to the random guess) with a negligible cost
in terms of the classification error.

介绍了一种隐私机制，用于训练机器学习模型以保证隐私，并使用敌对训练算法最小化模型的分类损失和最大的成员推断攻击，从而提高模型的鲁棒性和泛化性能，该机制在深度神经网络上的测试结果表明，可以在可接受的分类误差下显著降低成员推断攻击的风险。

使用对抗正则化的成员隐私机器学习

Machine Learning with Membership Privacy using Adversarial  Regularization

We present a data-driven framework called generative adversarial privacy
(GAP). Inspired by recent advancements in generative adversarial networks
(GANs), GAP allows the data holder to learn the privatization mechanism
directly from the data. Under GAP, finding the optimal privacy mechanism is
formulated as a constrained minimax game between a privatizer and an adversary.
We show that for appropriately chosen adversarial loss functions, GAP provides
privacy guarantees against strong information-theoretic adversaries. We also
evaluate GAP's performance on the GENKI face database.

本文介绍了一种数据驱动的框架 —— 生成对抗隐私（GAP），可以让数据持有者直接从数据中学习隐私保护机制，并提供了适当选择对抗损失函数时的隐私保证。