我们提供了一种差异化私有算法，用于同时生成多个任务的合成数据：边际查询和多任务机器学习（ML）。我们算法中的一个关键创新是能够直接处理数值特征的能力，与许多相关的先验方法相反，这些方法需要首先通过{binning策略}将数值特征转换为{高基数}分类特征。为了提高准确性，需要较高的分子粒度，但这会对可伸缩性产生负面影响。消除对套在一起的需求使我们能够产生合成数据，以保留大量统计查询，例如数值特征的边际和条件线性阈值查询。保留后者意味着在特定半空间上方的每个类标记的点的比例在实际数据和合成数据中都大致相同。这是在多任务设置中训练线性分类器所需的属性。我们的算法还使我们能够为混合边缘查询提供高质量的合成数据，这些数据结合了分类和数值特征。我们的方法始终比最佳可比技术快2-5倍，并在边缘查询和混合型数据集的线性预测任务方面提供了显着的准确性改进。

我们研究私有综合数据生成查询版本，其中目标是构建差异隐私的敏感数据集的消毒版本，这大致保留了大量统计查询的答案。我们首先介绍一个算法框架，统一文献中的长线迭代算法。在此框架下，我们提出了两种新方法。第一种方法，私人熵投影（PEP），可以被视为MWEM的高级变体，可自适应地重复使用过去查询测量以提高精度。我们的第二种方法，具有指数机制（GEM）的生成网络，通过优化由神经网络参数化的生成模型来避免MWEM和PEP等算法中的计算瓶颈，该分布族捕获了丰富的分布系列，同时实现了快速的基于梯度的优化。我们展示了PEP和GEM经验胜过现有算法。此外，我们表明宝石很好地纳入了公共数据的先前信息，同时克服了PMW ^ PUB的限制，现有的现有方法也利用公共数据。

我们研究了分层数据集的差异私有合成数据生成的问题，其中各个数据点被分组在一起（例如，家庭中的人）。特别是，为了衡量合成数据集和基础私有数据集之间的相似性，我们在私人查询发布问题下构架了我们的目标，生成了一个合成数据集，该数据集可为某些查询收集（即统计数据统计数据，如平均汇总计数）保留答案。 。但是，尽管对私人合成数据的应用在查询释放问题中的应用进行了充分的研究，但此类研究仅限于非层次数据域，提出了最初的问题 - 在考虑这种形式的数据时，哪些查询很重要？此外，尚未确定如何在捕获此类统计数据的同时，如何在组和个体级别上生成合成数据。鉴于这些挑战，我们首先正式化了层次查询发行的问题，其中的目标是为某些层次数据集发布统计数据集。具体而言，我们提供了一组一般的统计查询，这些查询捕获了组和个体级别的属性之间的关系。随后，我们引入了私人合成数据算法，以进行层次查询发布，并在美国社区调查和Allegheny家庭筛查工具数据的层次数据集上进行评估。最后，我们研究了美国社区调查，其固有的层次结构产生了我们进行的另一组特定领域的查询。

机器学习的最新进展主要受益于大规模的可访问培训数据。但是，大规模的数据共享提出了极大的隐私问题。在这项工作中，我们提出了一种基于PAINE框架（G-PATE）的新型隐私保留数据生成模型，旨在训练可缩放的差异私有数据生成器，其保留高生成的数据实用程序。我们的方法利用生成的对抗性网来产生数据，与不同鉴别者之间的私人聚集相结合，以确保强烈的隐私保障。与现有方法相比，G-PATE显着提高了隐私预算的使用。特别是，我们用教师鉴别者的集合训练学生数据发生器，并提出一种新颖的私人梯度聚合机制，以确保对从教师鉴别者流到学生发电机的所有信息的差异隐私。另外，通过随机投影和梯度离散化，所提出的梯度聚合机制能够有效地处理高维梯度向量。从理论上讲，我们证明了G-PATE确保了数据发生器的差异隐私。经验上，我们通过广泛的实验证明了G-PAIN的优越性。我们展示了G-PATE是第一个能够在限量隐私预算下产生高数据实用程序的高维图像数据（$ \ epsilon \ LE 1 $）。我们的代码可在https://github.com/ai-secure/gate上获得。

A reconstruction attack on a private dataset $D$ takes as input some publicly accessible information about the dataset and produces a list of candidate elements of $D$. We introduce a new class of data reconstruction attacks based on randomized methods for non-convex optimization. We empirically demonstrate that our attacks can not only reconstruct full rows of $D$ from aggregate query statistics $Q(D)\in \mathbb{R}^m$, but can do so in a way that reliably ranks reconstructed rows by their odds of appearing in the private data, providing a signature that could be used for prioritizing reconstructed rows for further actions such as identify theft or hate crime. We also design a sequence of baselines for evaluating reconstruction attacks. Our attacks significantly outperform those that are based only on access to a public distribution or population from which the private dataset $D$ was sampled, demonstrating that they are exploiting information in the aggregate statistics $Q(D)$, and not simply the overall structure of the distribution. In other words, the queries $Q(D)$ are permitting reconstruction of elements of this dataset, not the distribution from which $D$ was drawn. These findings are established both on 2010 U.S. decennial Census data and queries and Census-derived American Community Survey datasets. Taken together, our methods and experiments illustrate the risks in releasing numerically precise aggregate statistics of a large dataset, and provide further motivation for the careful application of provably private techniques such as differential privacy.

我们考虑一个顺序设置，其中使用单个数据集用于执行自适应选择的分析，同时确保每个参与者的差别隐私丢失不超过预先指定的隐私预算。此问题的标准方法依赖于限制所有个人对所有个人的隐私损失的最坏情况估计，以及每个单一分析的所有可能的数据值。然而，在许多情况下，这种方法过于保守，特别是对于“典型”数据点，通过参与大部分分析产生很少的隐私损失。在这项工作中，我们基于每个分析中每个人的个性化隐私损失估计的价值，给出了更严格的隐私损失会计的方法。实现我们设计R \'enyi差异隐私的过滤器。过滤器是一种工具，可确保具有自适应选择的隐私参数的组合算法序列的隐私参数不超过预先预算。我们的过滤器比以往的$（\ epsilon，\ delta）$ - rogers等人的差别隐私更简单且更紧密。我们将结果应用于对嘈杂渐变下降的分析，并显示个性化会计可以实用，易于实施，并且只能使隐私式权衡更紧密。

When analyzing confidential data through a privacy filter, a data scientist often needs to decide which queries will best support their intended analysis. For example, an analyst may wish to study noisy two-way marginals in a dataset produced by a mechanism M1. But, if the data are relatively sparse, the analyst may choose to examine noisy one-way marginals, produced by a mechanism M2 instead. Since the choice of whether to use M1 or M2 is data-dependent, a typical differentially private workflow is to first split the privacy loss budget rho into two parts: rho1 and rho2, then use the first part rho1 to determine which mechanism to use, and the remainder rho2 to obtain noisy answers from the chosen mechanism. In a sense, the first step seems wasteful because it takes away part of the privacy loss budget that could have been used to make the query answers more accurate. In this paper, we consider the question of whether the choice between M1 and M2 can be performed without wasting any privacy loss budget. For linear queries, we propose a method for decomposing M1 and M2 into three parts: (1) a mechanism M* that captures their shared information, (2) a mechanism M1' that captures information that is specific to M1, (3) a mechanism M2' that captures information that is specific to M2. Running M* and M1' together is completely equivalent to running M1 (both in terms of query answer accuracy and total privacy cost rho). Similarly, running M* and M2' together is completely equivalent to running M2. Since M* will be used no matter what, the analyst can use its output to decide whether to subsequently run M1'(thus recreating the analysis supported by M1) or M2'(recreating the analysis supported by M2), without wasting privacy loss budget.

We study the task of training regression models with the guarantee of label differential privacy (DP). Based on a global prior distribution on label values, which could be obtained privately, we derive a label DP randomization mechanism that is optimal under a given regression loss function. We prove that the optimal mechanism takes the form of a ``randomized response on bins'', and propose an efficient algorithm for finding the optimal bin values. We carry out a thorough experimental evaluation on several datasets demonstrating the efficacy of our algorithm.

深度神经网络（DNNS）铰接对大型数据集的可用性的最新成功;但是，对此类数据集的培训经常为敏感培训信息构成隐私风险。在本文中，我们的目标是探讨生成模型和梯度稀疏性的力量，并提出了一种可扩展的隐私保留生成模型数据标准。与标准展示隐私保留框架相比，允许教师对一维预测进行投票，在高维梯度向量上投票在隐私保存方面具有挑战性。随着需要尺寸减少技术，我们需要在（1）之间的改进之间导航精致的权衡空间，并进行SGD收敛的放缓。为了解决这一点，我们利用通信高效学习，并通过将顶-K压缩与相应的噪声注入机构相结合，提出一种新的噪声压缩和聚集方法TopAGG。理论上，我们证明了DataLens框架保证了其生成数据的差异隐私，并提供了其收敛性的分析。为了展示DataLens的实际使用情况，我们对不同数据集进行广泛的实验，包括Mnist，Fashion-Mnist和高维Celeba，并且我们表明，DataLens显着优于其他基线DP生成模型。此外，我们改进了所提出的Topagg方法，该方法是DP SGD培训的主要构建块之一，并表明它能够在大多数情况下实现比最先进的DP SGD方法更高的效用案件。我们的代码在HTTPS://github.com/ai-secure/datalens公开提供。

我们展示了一个联合学习框架，旨在强大地提供具有异构数据的各个客户端的良好预测性能。所提出的方法对基于SuperQualile的学习目标铰接，捕获异构客户端的误差分布的尾统计。我们提出了一种随机训练算法，其与联合平均步骤交织差异私人客户重新重量步骤。该提出的算法支持有限时间收敛保证，保证覆盖凸和非凸面设置。关于联邦学习的基准数据集的实验结果表明，我们的方法在平均误差方面与古典误差竞争，并且在误差的尾统计方面优于它们。

虽然在巨大数据上培训的机器学习模型导致了几个领域的断路器，但由于限制数据的访问，他们在隐私敏感域中的部署仍然有限。在私有数据上具有隐私约束的生成模型可以避免此挑战，而是提供对私有数据的间接访问。我们提出DP-Sinkhorn，一种新的最优传输的生成方法，用于从具有差异隐私的私有数据学习数据分布。 DP-Sinkhorn以差别私人方式在模型和数据之间的模型和数据之间最小化陷阱的分歧，将计算上有效的近似值，并在模型和数据之间使用新技术来控制梯度估计的偏差差异的偏差折衷。与现有的培训方法不同，差异私人生成模型主要基于生成的对抗网络，我们不依赖于对抗性目标，这令人惊叹的难以优化，特别是在隐私约束所施加的噪声存在下。因此，DP-Sinkhorn易于训练和部署。通过实验，我们改进了多种图像建模基准的最先进，并显示了差异私有的信息RGB图像综合。项目页面：https：//nv-tlabs.github.io/dp-sinkhorn。

Although query-based systems (QBS) have become one of the main solutions to share data anonymously, building QBSes that robustly protect the privacy of individuals contributing to the dataset is a hard problem. Theoretical solutions relying on differential privacy guarantees are difficult to implement correctly with reasonable accuracy, while ad-hoc solutions might contain unknown vulnerabilities. Evaluating the privacy provided by QBSes must thus be done by evaluating the accuracy of a wide range of privacy attacks. However, existing attacks require time and expertise to develop, need to be manually tailored to the specific systems attacked, and are limited in scope. In this paper, we develop QuerySnout (QS), the first method to automatically discover vulnerabilities in QBSes. QS takes as input a target record and the QBS as a black box, analyzes its behavior on one or more datasets, and outputs a multiset of queries together with a rule to combine answers to them in order to reveal the sensitive attribute of the target record. QS uses evolutionary search techniques based on a novel mutation operator to find a multiset of queries susceptible to lead to an attack, and a machine learning classifier to infer the sensitive attribute from answers to the queries selected. We showcase the versatility of QS by applying it to two attack scenarios, three real-world datasets, and a variety of protection mechanisms. We show the attacks found by QS to consistently equate or outperform, sometimes by a large margin, the best attacks from the literature. We finally show how QS can be extended to QBSes that require a budget, and apply QS to a simple QBS based on the Laplace mechanism. Taken together, our results show how powerful and accurate attacks against QBSes can already be found by an automated system, allowing for highly complex QBSes to be automatically tested "at the pressing of a button".

With the development of machine learning and data science, data sharing is very common between companies and research institutes to avoid data scarcity. However, sharing original datasets that contain private information can cause privacy leakage. A reliable solution is to utilize private synthetic datasets which preserve statistical information from original datasets. In this paper, we propose MC-GEN, a privacy-preserving synthetic data generation method under differential privacy guarantee for machine learning classification tasks. MC-GEN applies multi-level clustering and differential private generative model to improve the utility of synthetic data. In the experimental evaluation, we evaluated the effects of parameters and the effectiveness of MC-GEN. The results showed that MC-GEN can achieve significant effectiveness under certain privacy guarantees on multiple classification tasks. Moreover, we compare MC-GEN with three existing methods. The results showed that MC-GEN outperforms other methods in terms of utility.

内核平均嵌入是表示和比较概率度量的有用工具。尽管具有有用性，但内核的意思是考虑无限维度的特征，在差异私有数据生成的背景下，这是具有挑战性的。最近的一项工作建议使用有限维的随机特征近似数据分布的内核平均值嵌入，从而产生可分析的敏感性。但是，所需的随机特征的数量过高，通常是一千到十万，这会使隐私准确的权衡加剧。为了改善权衡取舍，我们建议用Hermite多项式特征替换随机功能。与随机特征不同，储能多项式特征是排序的，其中低订单的特征包含的分布更多的信息比高订单处的分布更多。因此，与明显更高的随机特征相比，HERMITE多项式特征的相对较低的阶多项式特征可以更准确地近似数据分布的平均嵌入。正如在几个表格和图像数据集中所证明的那样，Hermite多项式特征似乎比随机傅立叶功能更适合私人数据生成。

尽管在文本，图像和视频上生成的对抗网络（GAN）取得了显着的成功，但由于一些独特的挑战，例如捕获不平衡数据中的依赖性，因此仍在开发中，生成高质量的表格数据仍在开发中，从而优化了合成患者数据的质量。保留隐私。在本文中，我们提出了DP-CGAN，这是一个由数据转换，采样，条件和网络培训组成的差异私有条件GAN框架，以生成现实且具有隐私性的表格数据。 DP-Cgans区分分类和连续变量，并将它们分别转换为潜在空间。然后，我们将条件矢量构建为附加输入，不仅在不平衡数据中介绍少数族裔类，还可以捕获变量之间的依赖性。我们将统计噪声注入DP-CGAN的网络训练过程中的梯度，以提供差异隐私保证。我们通过统计相似性，机器学习绩效和隐私测量值在三个公共数据集和两个现实世界中的个人健康数据集上使用最先进的生成模型广泛评估了我们的模型。我们证明，我们的模型优于其他可比模型，尤其是在捕获变量之间的依赖性时。最后，我们在合成数据生成中介绍了数据实用性与隐私之间的平衡，考虑到现实世界数据集的不同数据结构和特征，例如不平衡变量，异常分布和数据的稀疏性。

线性回归是统计分析的基本工具。这激发了线性回归方法的开发，这些方法也满足了差异隐私，因此可以保证，学到的模型几乎没有揭示用于构建它的任何一个数据点。但是，现有的差异化解决方案假设最终用户可以轻松指定良好的数据范围和超参数。两者都有重大的实践障碍。在本文中，我们研究了一种算法，该算法使用指数机制从非私有回归模型集合中选择具有高图基深度的模型。给定用于训练$ m $型号的$ d $二维数据的$ n $样品，我们使用近似Tukey深度构建一个有效的模拟，该深度在时间$ o（d^2n + dm \ log（m））$中构建。我们发现该算法在数据范围或不需要的超参数选择的情况下获得了强大的经验性能。

HyperParameter优化是机器学习中的一种无处不在的挑战，训练型模型的性能在其有效选择时依赖于大致依赖。虽然为此目的存在丰富的工具，但目前在差分隐私（DP）的约束下，目前没有实际的超参数选择方法。我们研究鉴于差异私立机器学习的诚实的封锁，其中，在整体隐私预算中占了超代调优的过程。为此，我们）显示标准的组合工具在许多设置中优于更高级的技术，ii）经验和理论上展示了学习率和剪辑规范率HyperParameters，III之间的内在联系，表明DPADAM等自适应优化器享有显着的优势在诚实的HyperParameter调整过程中，IV）借鉴了DP设置中ADAM的新颖限制行为，以设计新的更高效的优化器。

接受差异隐私（DP）训练的生成模型可用于生成合成数据，同时最大程度地降低隐私风险。我们分析了DP对数据的影响不足的数据/子组的影响，特别是研究：1）合成数据中类/子组的大小和2）分类任务的准确性在其上运行。我们还评估了各种不平衡和隐私预算的影响。我们的分析使用了三种最先进的DP模型（Privbayes，DP-WGAN和PATE-GAN），并表明DP在生成的合成数据中产生相反的大小分布。它影响了多数族裔和少数族裔/亚组之间的差距；在某些情况下，通过减少它（一种“罗宾汉”效应），而在其他情况下则通过增加它（一种“马修”效应）。无论哪种方式，这都会导致（类似）对合成数据的分类任务准确性的（类似）不同的影响，从而更加不成比例地影响了代表性不足的数据。因此，当培训模型对合成数据时，可能会导致不均匀地处理不同亚群的风险，从而得出不可靠或不公平的结论。

Machine learning (ML) models may be deemed confidential due to their sensitive training data, commercial value, or use in security applications. Increasingly often, confidential ML models are being deployed with publicly accessible query interfaces. ML-as-a-service ("predictive analytics") systems are an example: Some allow users to train models on potentially sensitive data and charge others for access on a pay-per-query basis.The tension between model confidentiality and public access motivates our investigation of model extraction attacks. In such attacks, an adversary with black-box access, but no prior knowledge of an ML model's parameters or training data, aims to duplicate the functionality of (i.e., "steal") the model. Unlike in classical learning theory settings, ML-as-a-service offerings may accept partial feature vectors as inputs and include confidence values with predictions. Given these practices, we show simple, efficient attacks that extract target ML models with near-perfect fidelity for popular model classes including logistic regression, neural networks, and decision trees. We demonstrate these attacks against the online services of BigML and Amazon Machine Learning. We further show that the natural countermeasure of omitting confidence values from model outputs still admits potentially harmful model extraction attacks. Our results highlight the need for careful ML model deployment and new model extraction countermeasures.

Differential privacy is a strong notion for privacy that can be used to prove formal guarantees, in terms of a privacy budget, , about how much information is leaked by a mechanism. However, implementations of privacy-preserving machine learning often select large values of in order to get acceptable utility of the model, with little understanding of the impact of such choices on meaningful privacy. Moreover, in scenarios where iterative learning procedures are used, differential privacy variants that offer tighter analyses are used which appear to reduce the needed privacy budget but present poorly understood trade-offs between privacy and utility. In this paper, we quantify the impact of these choices on privacy in experiments with logistic regression and neural network models. Our main finding is that there is a huge gap between the upper bounds on privacy loss that can be guaranteed, even with advanced mechanisms, and the effective privacy loss that can be measured using current inference attacks. Current mechanisms for differentially private machine learning rarely offer acceptable utility-privacy trade-offs with guarantees for complex learning tasks: settings that provide limited accuracy loss provide meaningless privacy guarantees, and settings that provide strong privacy guarantees result in useless models.