Calculating the privacy for the standard optimizer

Dear all,

I would like to extend the question that was raised in the Issue https://github.com/tensorflow/privacy/issues/136

I would like to know how much worse is it to run a standard optimizer, such as Adam, in terms of privacy:

from sklearn.model_selection import train_test_split
from sklearn.datasets import load_wine
import tensorflow as tf
import matplotlib.pyplot as plt
from tensorflow_privacy.privacy.analysis import compute_dp_sgd_privacy
from tensorflow_privacy.privacy.optimizers.dp_optimizer import DPGradientDescentGaussianOptimizer

features, target = load_wine(return_X_y=True)
X_train, X_test, y_train, y_test = train_test_split(features, target, test_size=0.30, random_state=42)
y_train, y_test = tf.keras.utils.to_categorical(y_train), tf.keras.utils.to_categorical(y_test)

input_dim = X_train.shape[1]
class_num = y_train.shape[1]

model = tf.keras.Sequential()
model.add(tf.keras.layers.Dense(units=50, activation='relu', input_dim=input_dim))
model.add(tf.keras.layers.Dense(units=class_num, activation='softmax'))

l2_norm_clip = 1.5
noise_multiplier = 1.3
num_microbatches = 1
learning_rate = 0.007

optimizer = tf.keras.optimizers.Adam(lr=learning_rate)

'''
optimizer = DPGradientDescentGaussianOptimizer(
    l2_norm_clip=l2_norm_clip,
    noise_multiplier=noise_multiplier,
    num_microbatches=num_microbatches,
    learning_rate=learning_rate)
'''

model.compile(loss='categorical_crossentropy', optimizer=optimizer, metrics=['accuracy'])
history = model.fit(X_train, y_train, epochs=800, validation_data=(X_test, y_test), shuffle=False, verbose=0)

compute_dp_sgd_privacy.compute_dp_sgd_privacy(n=60000, batch_size=1, noise_multiplier=1.3, epochs=15, delta=1e-5)

As https://github.com/tensorflow/privacy/issues/136 stated, we cannot use compute_dp_sgd_privacy because it assumes randomization and Adam does not perform this way. Is there any other way to measure privacy of the Adam optimizer?

Thank you for your help.

Best regards,
Felix

Start by reading linked issue 136 and the compute_dp_sgd_privacy entry point mentioned in tensorflow_privacy.privacy.analysis, then compare its assumptions with the Adam optimizer example. Done would require a defined privacy-accounting approach for Adam, but this issue does not specify an implementation or acceptance test.