Understanding Impacts of Differential Privacy: A Unified Framework with Two-Layer Neural Networks
differential privacy;two-layer neural networks;disparate impact
I have read and agree with the venue's withdrawal policy on behalf of myself and my co-authors.
We theorectically study the effects of differential privacy including bad learning features, disparate impact, worse adversarial robustness, and techniques such as pre-training and data augmentationsin two-layer ReLU neural networks.
@misc{
xu2024understanding,
title={Understanding Impacts of Differential Privacy: A Unified Framework with Two-Layer Neural Networks},
author={Ruichen Xu and Kexin Chen},
year={2024},
url={https://openreview.net/forum?id=B9e0sSifvS}
}
With the growing demand for data and the increasing awareness of privacy, differentially private learning has been widely applied in various deep models. Experiments have observed several side effects of differentially private learning, including bad learning features (performance), disparate impact, and worse adversarial robustness that hurt the trustworthiness of the trained models. Recent works have expected pre-training to mitigate these side effects. It is valuable to theoretically understand the impact of differential privacy on the training process. However, existing theoretical research only explained parts of the phenomena and failed to extend to non-convex and non-smooth neural networks. To fill this gap, we propose a unified framework to explain all the above phenomena by studying the feature learning process of differentially private stochastic gradient descent in two-layer ReLU convolutional neural networks. By analyzing the test loss, we find both its upper and lower bound decrease with feature-to-noise ratios (FNRs). We then show that disparate impact comes from imbalanced FNRs among different classes and subpopulation groups. Additionally, we show that the suboptimal learned features and reduced adversarial robustness are caused by the randomness of privacy-preserving noise introduced into the learned features. Moreover, we demonstrate that pre-training cannot always improve the model performance, especially with increased feature differences in the pre-training and fine-tuning datasets. Numerical results on both synthetic and real-world datasets validate our theoretical analyses.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
~Ruichen_Xu1 ~Kexin_Chen4
Ruichen Xu Kexin Chen
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
differential privacy two-layer neural networks disparate impact
I certify that there is no acknowledgement section in this submission for double blind review.
xu|understanding_impacts_of_differential_privacy_a_unified_framework_with_twolayer_neural_networks
/pdf/66caf12be70e945eac94bb8c181fbb5f8e52f9b3.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
/attachment/3e920bab6716fa165a59a3eb634710a6ec30f263.zip
Understanding Impacts of Differential Privacy: A Unified Framework with Two-Layer Neural Networks
ICLR 2025 Conference Withdrawn Submission
ICLR.cc/2025/Conference/Withdrawn_Submission