Privacy filters and odometers for deep learning
Generally discussed herein are devices, systems, and methods for improving phishing webpage content detection. A method can include instantiating an odometer with a nested privacy filter architecture, the nested privacy filter including privacy filters of different, increasing sizes, training a DL model, maintaining, during training and by a privacy odometer that operates using the nested privacy filter, a running total of privacy loss budget consumed by the training, and responsive to a query for the total privacy loss budget consumed, returning, by the odometer, a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget.
1. A compute device comprising:
processing circuitry;
a memory coupled to the processing circuitry, the memory including instructions that, when executed by the processing circuitry, cause the processing circuitry to perform operations for differential privacy (DP) deep learning (DL) model generation, the operations comprising:
instantiating a privacy odometer with a nested privacy filter architecture, the nested privacy filter architecture including nested privacy filters of different, increasing sizes;
training a DL model;
maintaining, during the training and by the privacy odometer that operates using the nested privacy filters, a running total of privacy loss budget consumed by the training; and
responsive to a query for the running total of the privacy loss budget consumed, returning, by the privacy odometer, a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget.
2. The compute device of claim 1 , wherein the operations further comprise, after a specified number of iterations of training the DL model, determining a DL model characteristic of the DL model and accounting for a privacy loss budget consumed in determining the DL model characteristic.
3. The compute device of claim 2 , wherein the DL model characteristic includes an overall training set accuracy of the DL model or a difference in training set accuracy between a current epoch and an immediately prior epoch.
4. The compute device of claim 3 , wherein:
the DL model characteristic is the difference in training set accuracy; and
the operations further comprise, responsive to determining the difference in training set accuracy satisfies a first criterion, decreasing an amount of privacy budget consumed in an immediately subsequent epoch.
5. The compute device of claim 4 , wherein decreasing the amount of privacy budget consumed includes increasing an amount of noise applied to a gradient computation for updating the DL model.
6. The compute device of claim 4 , wherein decreasing the amount of privacy budget consumed includes decreasing a batch size of training data for a next epoch.
7. The compute device of claim 4 , wherein the operations further comprise, responsive to determining the difference in training set accuracy satisfies a different, second criterion, increasing an amount of privacy budget consumed in an immediately subsequent epoch.
8. The compute device of claim 3 , wherein:
the DL model characteristic includes the overall training set accuracy of the DL model; and
the operations further comprise, responsive to determining the overall training set accuracy satisfies a third criterion, terminating the training.
9. The compute device of claim 1 , wherein the operations further comprise, responsive to determining the running total of the privacy loss budget consumed is such that a next iteration of training will make the running total of the privacy loss budget consumed exceed a total allowable privacy loss, terminating the training.
10. The compute device of claim 9 , wherein the operations further comprise receiving, from a user and by a user interface, the total allowable privacy loss.
11. A method for differentially private (DP) deep learning (DL) model generation, the method comprising:
instantiating a privacy odometer with a nested privacy filter architecture, the nested privacy filter architecture including nested privacy filters of different, increasing sizes;
training a DL model;
maintaining, during the training and by the privacy odometer that operates using the nested privacy filters, a running total of privacy loss budget consumed by the training; and
responsive to a query for the running total of the privacy loss budget consumed, returning, by the privacy odometer, a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget.
12. The method of claim 11 , further comprising, after a specified number of iterations of training the DL model, determining a DL model characteristic of the DL model and accounting for a privacy loss budget consumed in determining the DL model characteristic.
13. The method of claim 12 , wherein the DL model characteristic includes an overall training set accuracy of the DL model or a difference in training set accuracy between a current epoch and an immediately prior epoch.
14. The method of claim 13 , wherein:
the DL model characteristic is the difference in training set accuracy; and
the method further comprises, responsive to determining the difference in training set accuracy satisfies a first criterion, decreasing an amount of privacy budget consumed in an immediately subsequent epoch.
15. The method of claim 14 , wherein decreasing the amount of privacy budget consumed includes increasing an amount of noise applied to a gradient computation for updating the DL model.
16. The method of claim 14 , wherein decreasing the amount of privacy budget consumed includes decreasing a batch size of training data for a next epoch.
17. The method of claim 14 , further comprising, responsive to determining the difference in training set accuracy satisfies a different, second criterion, increasing an amount of privacy budget consumed in an immediately subsequent epoch.
18. The method of claim 13 , wherein:
the DL model characteristic includes the overall training set accuracy of the DL model; and
the method further comprises, responsive to determining the overall training set accuracy satisfies a second criterion, terminating the training.
19. A non-transitory machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations for differentially private (DP) deep learning (DL) model generation, the operations comprising:
instantiating a privacy odometer with a nested privacy filter architecture, the nested privacy filter architecture including nested privacy filters of different, increasing sizes;
maintaining, during training of a DL model and by the privacy odometer that operates using the nested privacy filters, a running total of privacy loss budget consumed by the training;
responsive to a query, returning (i) a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget and (ii) an overall training set accuracy of the DL model; and
responsive to receiving data indicating to halt the training of the DL model, terminating the training of the DL model.
20. The non-transitory, machine-readable medium of claim 19 , wherein the operations further comprise, responsive to determining the running total of the privacy loss budget consumed is such that a next iteration of training will make the running total of the privacy loss budget consumed exceed a total allowable privacy loss, terminating the training of the DL model.